Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


03:43 PM
Wolfgang Kandek
Wolfgang Kandek

Adobe Reader's Patch Tuesday

Next Tuesday, Jan. 12, is Microsoft Patch Tuesday. Beyond the usual patches from Microsoft, we will also get a critical update for a piece of software that increasingly plays a role in exploiting desktop systems -- the Adobe Reader from Adobe Systems.

Next Tuesday, Jan. 12, is Microsoft Patch Tuesday. Beyond the usual patches from Microsoft, we will also get a critical update for a piece of software that increasingly plays a role in exploiting desktop systems -- the Adobe Reader from Adobe Systems.In 2009, the flaws in the Adobe Reader program were the target of choice for many attackers. Adobe Reader is a program that allows reading, printing, and form-filling of PDF files, a very popular document file format. The Reader program is downloadable for free directly from Adobe and often comes preinstalled on PCs. It is cross-platform, working in similar ways on Windows, Mac OS X, and Linux/Unix. Flaws in the Reader program can also be cross-platform, making it a very attractive attack target, with an installed base larger than Windows itself.

In the past year, security researchers and exploit writers have found many security holes in the product, a number of which are included in commercial exploit kits that can be purchased online. These exploit kits allow anybody with basic technical knowledge to craft an attack file that can be sent by e-mail and planted on popular Websites for download. Often the files generated have a "serious" subject -- how to protect oneself from the swine flu, news about tax returns, etc. -- making them more successful because many users do not expect an attack from these type of files.

On several occasions, flaws were found in Adobe Reader by attackers rather than security researchers and became exploits before Adobe was able to issue a patch. There were three instances of these so-called zero-day vulnerabilities in 2009, with the latest on schedule to be fixed next week.

The frequency and severity of these flaws make it a top priority to decide on how to deal with PDF file format attacks in any organization's 2010 security to-do lists. But no matter what the final decision is, it is essential to update to the latest software version, use an alternative PDF reader that is less scrutinized by attackers, perhaps just uninstall the software, and create an inventory of existing installed version. All modern vulnerability management tools cover Adobe Reader vulnerabilities and provide that inventory mechanism. Typical system management solutions also offer a way to catalog installed software; a number of free programs also are available that can help a smaller organization's needs.

-- As the CTO for Qualys, Wolfgang Kandek is responsible for product direction and all operational aspects of the QualysGuard platform and its infrastructure. Wolfgang has more than 20 years of experience in developing and managing information systems. His focus has been on Unix-based server architectures and application delivery through the Internet. Wolfgang provides the latest commentary on his blog: laws.qualys.com and also publishes his Patch Tuesday commentary to the QualysGuard channel: www.youtube.com/QualysGuard. He is a frequent source in business and trade media and speaks at industry conferences around the world, most recently at RSA 2009.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
7 Ways VPNs Can Turn from Ally to Threat
Curtis Franklin Jr., Senior Editor at Dark Reading,  9/21/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-09-21
An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.
PUBLISHED: 2019-09-21
The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to file disclosure and XSS.
PUBLISHED: 2019-09-21
An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF.
PUBLISHED: 2019-09-21
admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route.
PUBLISHED: 2019-09-21
Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.