Adobe Reader purged of hole that was under attack
22 other bugs also exterminated
Adobe has patched 23 security vulnerabilities in its Reader document viewer, including one that criminals were exploiting to install malware on the PCs of unwitting victims.
At least 18 of the other flaws also made it possible for attackers to remotely hijack users' PCs, Adobe said in an bulletin released on Tuesday. The patch updates Reader and its sister application, Acrobat, to versions 9.4 and 8.2.5.
Adobe accelerated the release of the patch after researcher Mila Parkour uncovered a sophisticated attack circulating by email that exploited a stack overflow. The exploit was notable because it bypassed defensive protections Microsoft has built into more recent versions of Windows, such as ASLR, or address space layout randomization, and DEP, or data execution prevention. (The bypass was made possible by a programming mistake on Adobe's part.)
The booby-trapped PDF files, which were sent to select individuals and company employees, also contained three separate font packages so they worked on multiple versions of the Adobe programs. To allay victims' suspicions, the malware used a stolen digital certificate to sign some of its files.
Another vulnerability addressed in Tuesday's update actually resides in code associated with the Adobe Flash Player that's embedded in Reader and Acrobat. Attackers were exploiting the flaw in Flash until Adobe squashed the bug in that application last month. There are no reports so far that it was targeted in the company's PDF software.
It's been a tough couple of years for Adobe, which by many estimates is the second most attacked software maker behind Microsoft. With its highly complex code residing in the vast majority of the world's PCs, it allows exploit writers to maximize their profits.
Adobe has responded to the attacks by designing a security sandbox for Reader and Acrobat that will separate the applications' processes from the critical functioning of the underlying operating system. Of the dozen or so real-world attacks that have exploited vulnerabilities in Reader over the past few years, none of them would have succeeded against the application had it employed the sandbox, Adobe's senior director of product security and privacy, Brad Arkin, said in July.
The feature, to be called Adobe Reader Protected Mode, will be included in the next major release of the application, which is due out before the end of the year. Adobe's Kyle Randolph released an initial round of technical details about the new design on Tuesday here.
Building a sandbox into an application as complex as Reader has been compared by some to adding a basement to a 20-story building after it's already been erected. Versions 7 and 8 of Internet Explorer have a similar feature, and so does Google's Chrome browser.
Adobe's plans to follow suit shows it is making good on its promise to make its users safer. One area where the company can still improve is its warning to those updating Reader and Flash that they may need to temporarily disable their anti-virus software. This kluge puts users at risk. It's time Adobe developers fixed it. ®
But Acrobat Pro is vulnerable unless you go through update hell
The updates for Acrobat Professional aren't cumulative. For a new install, have to install 9.0 and then go from 9.1 to 9.1.3 to 9.2 to 9.3 to 9.3.2 to 9.3.3 to 9.4 to get an up-to-date Acrobat Pro installation (I think that's the shortest path). Good luck in an enterprise environment.
They've never refreshed the original installation media, not even the downloadable demo, and you can't get refreshed media from Adobe. If you try, they tell you things like "Acrobat Pro 10 will fix it". Why yes. Until 10.1 comes out. And then 10.1.3. And then 10.2. And you recreate the problem.
Or, hey, here's an idea. Make the update installers cumulative. That would solve the problem. And far more complicated products (Microsoft Office, Windows) seem to be able to handle it just fine.
..and it still drops an utterly useless and unwanted program icon on the desktop.
RE : Building analogies. →
I think it's the WINDOWS that are as much to blame