Vulnerabilities / Threats
7/20/2009
02:29 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Adobe Offering Insecure Reader Software

Plagued by a series of vulnerabilities in its Reader software, Adobe has been tightening its security. Yet the company hasn't gotten around to offering a secure version of Reader on its Web site.

Despite making a commitment earlier this year to scrutinize its code for bugs more closely, Adobe is offering insecure software on its Web site.

Adobe's Web site makes Adobe Reader 9.10 available to users. Yet in May the company released Reader 9.11 to address at least one critical vulnerability. And in June the company released Reader 9.12 to fix nine critical vulnerabilities.

Secunia, a computer security company based in Denmark, said its Personal Software Inspector (PSI) tool will help users identify Adobe's out-of-date software.

Mikkel Winther, PSI partner manager, said in an e-mailed statement, that PC users need to be diligent about patching. "They need to patch all their vulnerable programs and they need to do so as fast as possible after the patch has been issued from the vendor," he said. "Failing to do so is playing Russian Roulette with your IT security."

In an e-mailed statement, an Adobe spokesperson said, "Adobe Reader 9.1 for Windows is the most recent full installer of the product. Adobe Reader 9.1.1 and 9.1.2 for Windows are patches that require Adobe Reader 9.1 to be present. This is the reason users are offered Adobe Reader 9.1 via the 'Get Adobe Reader' page on Adobe.com. Once Adobe Reader 9.1 is installed, the Adobe Updater will subsequently offer the Adobe Reader 9.1.1 and 9.1.2 patches. Or, alternately, the end user can manually apply the patches via the Product updates section of our Web site."

The problem with this approach is that there's a window of vulnerability between the time that the user downloads the software and the time that the software gets patched by Adobe's update tool.

Adobe didn't immediately respond to a follow-up question about how long that window of vulnerability might last.

That period of vulnerability might be extended if the user declines to accept, or defers, an update because he or she does not want to be interrupted at the moment the updater requests authorization.

Were a user without Reader installed to click on a malicious PDF file on a Web site, the user's computer would be at risk because it would download a vulnerable version of Reader to open the unsafe PDF.

Update: Adobe says the the window of vulnerability is small because its updater tries to update Reader immediately and every seven days thereafter, automatically. However, the company acknowledges that the scenario suggested by Secunia -- clicking on a malicious PDF without Reader installed -- could lead to a compromised system.

An Adobe spokesperson explained, "The updater runs on a separate thread the main Reader process, so a user double-clicking on a PDF file would usually open the file (and trigger a possible attack) before the update manager could prompt the user to apply an update. The updater does not block the main Reader process from executing."

The company says it continues to look at ways to "to further narrow the window of exposure."

InformationWeek Analytics has published an independent analysis on data-loss prevention. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

CVE-2014-6395
Published: 2014-12-19
Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted password length value that is inconsistent with the actual length of the password...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.