Vulnerabilities / Threats
7/20/2009
02:29 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Adobe Offering Insecure Reader Software

Plagued by a series of vulnerabilities in its Reader software, Adobe has been tightening its security. Yet the company hasn't gotten around to offering a secure version of Reader on its Web site.

Despite making a commitment earlier this year to scrutinize its code for bugs more closely, Adobe is offering insecure software on its Web site.

Adobe's Web site makes Adobe Reader 9.10 available to users. Yet in May the company released Reader 9.11 to address at least one critical vulnerability. And in June the company released Reader 9.12 to fix nine critical vulnerabilities.

Secunia, a computer security company based in Denmark, said its Personal Software Inspector (PSI) tool will help users identify Adobe's out-of-date software.

Mikkel Winther, PSI partner manager, said in an e-mailed statement, that PC users need to be diligent about patching. "They need to patch all their vulnerable programs and they need to do so as fast as possible after the patch has been issued from the vendor," he said. "Failing to do so is playing Russian Roulette with your IT security."

In an e-mailed statement, an Adobe spokesperson said, "Adobe Reader 9.1 for Windows is the most recent full installer of the product. Adobe Reader 9.1.1 and 9.1.2 for Windows are patches that require Adobe Reader 9.1 to be present. This is the reason users are offered Adobe Reader 9.1 via the 'Get Adobe Reader' page on Adobe.com. Once Adobe Reader 9.1 is installed, the Adobe Updater will subsequently offer the Adobe Reader 9.1.1 and 9.1.2 patches. Or, alternately, the end user can manually apply the patches via the Product updates section of our Web site."

The problem with this approach is that there's a window of vulnerability between the time that the user downloads the software and the time that the software gets patched by Adobe's update tool.

Adobe didn't immediately respond to a follow-up question about how long that window of vulnerability might last.

That period of vulnerability might be extended if the user declines to accept, or defers, an update because he or she does not want to be interrupted at the moment the updater requests authorization.

Were a user without Reader installed to click on a malicious PDF file on a Web site, the user's computer would be at risk because it would download a vulnerable version of Reader to open the unsafe PDF.

Update: Adobe says the the window of vulnerability is small because its updater tries to update Reader immediately and every seven days thereafter, automatically. However, the company acknowledges that the scenario suggested by Secunia -- clicking on a malicious PDF without Reader installed -- could lead to a compromised system.

An Adobe spokesperson explained, "The updater runs on a separate thread the main Reader process, so a user double-clicking on a PDF file would usually open the file (and trigger a possible attack) before the update manager could prompt the user to apply an update. The updater does not block the main Reader process from executing."

The company says it continues to look at ways to "to further narrow the window of exposure."

InformationWeek Analytics has published an independent analysis on data-loss prevention. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-0658
Published: 2015-03-27
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.