Vulnerabilities / Threats
7/20/2009
02:29 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Adobe Offering Insecure Reader Software

Plagued by a series of vulnerabilities in its Reader software, Adobe has been tightening its security. Yet the company hasn't gotten around to offering a secure version of Reader on its Web site.

Despite making a commitment earlier this year to scrutinize its code for bugs more closely, Adobe is offering insecure software on its Web site.

Adobe's Web site makes Adobe Reader 9.10 available to users. Yet in May the company released Reader 9.11 to address at least one critical vulnerability. And in June the company released Reader 9.12 to fix nine critical vulnerabilities.

Secunia, a computer security company based in Denmark, said its Personal Software Inspector (PSI) tool will help users identify Adobe's out-of-date software.

Mikkel Winther, PSI partner manager, said in an e-mailed statement, that PC users need to be diligent about patching. "They need to patch all their vulnerable programs and they need to do so as fast as possible after the patch has been issued from the vendor," he said. "Failing to do so is playing Russian Roulette with your IT security."

In an e-mailed statement, an Adobe spokesperson said, "Adobe Reader 9.1 for Windows is the most recent full installer of the product. Adobe Reader 9.1.1 and 9.1.2 for Windows are patches that require Adobe Reader 9.1 to be present. This is the reason users are offered Adobe Reader 9.1 via the 'Get Adobe Reader' page on Adobe.com. Once Adobe Reader 9.1 is installed, the Adobe Updater will subsequently offer the Adobe Reader 9.1.1 and 9.1.2 patches. Or, alternately, the end user can manually apply the patches via the Product updates section of our Web site."

The problem with this approach is that there's a window of vulnerability between the time that the user downloads the software and the time that the software gets patched by Adobe's update tool.

Adobe didn't immediately respond to a follow-up question about how long that window of vulnerability might last.

That period of vulnerability might be extended if the user declines to accept, or defers, an update because he or she does not want to be interrupted at the moment the updater requests authorization.

Were a user without Reader installed to click on a malicious PDF file on a Web site, the user's computer would be at risk because it would download a vulnerable version of Reader to open the unsafe PDF.

Update: Adobe says the the window of vulnerability is small because its updater tries to update Reader immediately and every seven days thereafter, automatically. However, the company acknowledges that the scenario suggested by Secunia -- clicking on a malicious PDF without Reader installed -- could lead to a compromised system.

An Adobe spokesperson explained, "The updater runs on a separate thread the main Reader process, so a user double-clicking on a PDF file would usually open the file (and trigger a possible attack) before the update manager could prompt the user to apply an update. The updater does not block the main Reader process from executing."

The company says it continues to look at ways to "to further narrow the window of exposure."

InformationWeek Analytics has published an independent analysis on data-loss prevention. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio