Vulnerabilities / Threats

05:09 PM
Connect Directly

Adobe Fixes 29 Flaws In Acrobat And Reader

At least one of the vulnerabilities addressed is being actively exploited.

Microsoft wasn't the only company issuing a major security patch on Tuesday.

Adobe released a fix for 29 vulnerabilities in its Acrobat and Acrobat Reader software, warning that the vulnerabilities could be exploited to cause crashes and to take control of the user's computer.

Adobe rates the update as "crtical" and warns that one of the vulnerabilities (CVE-2009-3459) is actively being exploited.

Security company Trend Micro reported last week that it had discovered a zero-day exploit making use of this vulnerability. The malware consists of a PDF file with embedded JavaScript that executes arbitrary code using a technique called heap spraying.

A successful attack results in the installation of a backdoor that provides the attacker with unrestricted user-level access.

Affected software includes Adobe Reader 9.1.3 and Acrobat 9.1.3, Adobe Reader 8.1.6 and Acrobat 8.1.6 for Windows, Macintosh and UNIX, and Adobe Reader 7.1.3 and Acrobat 7.1.3 for Windows and Macintosh.

Updated software will become version 9.2, 8.17, or 7.14.

Adobe's software has become a popular target for cyber criminals because of its broad distribution.

According to the 2009 Top Cyber Security Risks report, released in September by the SANS Institute, "'File Format Vulnerabilities' continue to be the first choice for attackers to conduct zero-day and targeted attacks. Most of the attacks continue to target Adobe PDF, Flash Player and Microsoft Office Suite (PowerPoint, Excel and Word) software."

Adobe's Acrobat and Reader software accounted for four of the top 30 vulnerabilities cited in the report, with four more spots going to Adobe's Flash software.

The most influential event about the Enterprise 2.0 movement is coming to San Francisco this fall: Enterprise 2.0 Conference Find out more and register.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
New 'Mac-A-Mal' Tool Automates Mac Malware Hunting & Analysis
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/14/2018
IoT Product Safety: If It Appears Too Good to Be True, It Probably Is
Pat Osborne, Principal - Executive Consultant at Outhaul Consulting, LLC, & Cybersecurity Advisor for the Security Innovation Center,  3/12/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.