Vulnerabilities / Threats
7/20/2009
02:29 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Adobe Offering Insecure Reader Software

Plagued by a series of vulnerabilities in its Reader software, Adobe has been tightening its security. Yet the company hasn't gotten around to offering a secure version of Reader on its Web site.

Despite making a commitment earlier this year to scrutinize its code for bugs more closely, Adobe is offering insecure software on its Web site.

Adobe's Web site makes Adobe Reader 9.10 available to users. Yet in May the company released Reader 9.11 to address at least one critical vulnerability. And in June the company released Reader 9.12 to fix nine critical vulnerabilities.

Secunia, a computer security company based in Denmark, said its Personal Software Inspector (PSI) tool will help users identify Adobe's out-of-date software.

Mikkel Winther, PSI partner manager, said in an e-mailed statement, that PC users need to be diligent about patching. "They need to patch all their vulnerable programs and they need to do so as fast as possible after the patch has been issued from the vendor," he said. "Failing to do so is playing Russian Roulette with your IT security."

In an e-mailed statement, an Adobe spokesperson said, "Adobe Reader 9.1 for Windows is the most recent full installer of the product. Adobe Reader 9.1.1 and 9.1.2 for Windows are patches that require Adobe Reader 9.1 to be present. This is the reason users are offered Adobe Reader 9.1 via the 'Get Adobe Reader' page on Adobe.com. Once Adobe Reader 9.1 is installed, the Adobe Updater will subsequently offer the Adobe Reader 9.1.1 and 9.1.2 patches. Or, alternately, the end user can manually apply the patches via the Product updates section of our Web site."

The problem with this approach is that there's a window of vulnerability between the time that the user downloads the software and the time that the software gets patched by Adobe's update tool.

Adobe didn't immediately respond to a follow-up question about how long that window of vulnerability might last.

That period of vulnerability might be extended if the user declines to accept, or defers, an update because he or she does not want to be interrupted at the moment the updater requests authorization.

Were a user without Reader installed to click on a malicious PDF file on a Web site, the user's computer would be at risk because it would download a vulnerable version of Reader to open the unsafe PDF.

Update: Adobe says the the window of vulnerability is small because its updater tries to update Reader immediately and every seven days thereafter, automatically. However, the company acknowledges that the scenario suggested by Secunia -- clicking on a malicious PDF without Reader installed -- could lead to a compromised system.

An Adobe spokesperson explained, "The updater runs on a separate thread the main Reader process, so a user double-clicking on a PDF file would usually open the file (and trigger a possible attack) before the update manager could prompt the user to apply an update. The updater does not block the main Reader process from executing."

The company says it continues to look at ways to "to further narrow the window of exposure."

InformationWeek Analytics has published an independent analysis on data-loss prevention. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3352
Published: 2014-08-30
Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) 2008.3_SP9 and earlier does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, related to an "iFrame vulnerability," aka Bug ID CSCuh...

CVE-2014-3908
Published: 2014-08-30
The Amazon.com Kindle application before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2010-5110
Published: 2014-08-29
DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

CVE-2012-1503
Published: 2014-08-29
Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section.

CVE-2013-5467
Published: 2014-08-29
Monitoring Agent for UNIX Logs 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP04 and Monitoring Server (ms) and Shared Libraries (ax) 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP08, 6.2.3 through FP01, and 6.3.0 through FP01 in IBM Tivoli Monitoring (ITM)...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.