Vulnerabilities / Threats
4/8/2010
03:15 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Adobe Critical Security Patch Coming

The company plans to enable automatic updating without user intervention through a new software updater that comes with its security patch.

Adobe on Thursday said that it intends to release a critical security update for its Acrobat and Reader software next week, on Tuesday, April 13.

The company plans to address an undisclosed number of vulnerabilities in Adobe Reader 9.3.1 for Windows, Macintosh and UNIX, Adobe Acrobat 9.3.1 for Windows and Macintosh, and Adobe Reader 8.2.1 and Acrobat 8.2.1 for Windows and Macintosh.

A vulnerability identified last month in the ISO standard PDF specification, which can be used to trick users of PDF viewers like Adobe Reader and Foxit Reader into authorizing the execution an embedded executable, will not be addressed in next week's update.

"We are currently researching the best approach for this functionality in Adobe Reader and Acrobat, which we could conceivably make available during one of the regularly scheduled quarterly product updates," the company said on Tuesday.

The update will include an improved version of the software that Adobe uses to deliver its updates. The redesigned updater will give Windows users the option to automatically download and install Adobe updates. Macintosh users will continue to have to manually authorize the installation of updates that have been downloaded automatically.

"Adobe has no plans to activate the automatic update option by default without prior user consent," the company explained in an online post. "That said, the security of our users is a key priority for Adobe. The majority of attacks we are seeing are exploiting software installations that are not up-to-date with the latest security fixes. We therefore believe that the automatic update option is the best choice for most end-users."

A study published last year by Thomas Duebendorfer of Google Switzerland and Stefan Frei, then with the Swiss Federal Institute of Technology, found that the automatic, silent update mechanism used by Google Chrome provided better Web browser security that the update methods used in competing browsers that involved user notification and authorization.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0985
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName parameter.

CVE-2014-0986
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter.

CVE-2014-0987
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter.

CVE-2014-0988
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter.

CVE-2014-0989
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter.

Best of the Web
Dark Reading Radio