Vulnerabilities / Threats
9/9/2010
10:36 AM
50%
50%

Adobe Acrobat, Reader Under Attack From Zero-Day Exploit

Turning off JavaScript in Adobe Reader advised to protect against the critical vulnerability.




Slideshow: Cloud Security Pros And Cons
(click for larger image and for full photo gallery)
Adobe on Tuesday warned that attacks were actively exploiting a previously unknown, "critical" vulnerability in Adobe Acrobat and Reader.

The zero-day bug has been confirmed in all versions of 8 and 9 Acrobat and Reader releases for Windows, Macintosh, and Unix, including the latest versions, 8.2.4 and 9.3.4. A successful attack will exploit a user's system.

According to an advisory published by security information service Secunia, "the vulnerability is caused due to a boundary error within the font parsing in CoolType.dll and can be exploited to cause a stack-based buffer overflow."

The vulnerability employs a PDF file with built-in malicious code, which arrives as an e-mail attachment. Executing the PDF kicks off a variety of activities, including dropping an executable file into a temporary directory and attempting to run it. The dropped file, in a move reminiscent of Stuxnet, also carries a valid digital signature, in this case from Vantage Credit Union in St. Louis, said security researcher Roel Schouwenberg at Kaspersky Lab.

"The exploit is pretty basic," he said, but interestingly it employs return-oriented programming (ROP) to bypass some vulnerability mitigation techniques built into Windows Vista and 7. "More widespread usage of ROP for exploits is something I've been expecting for a while," he said, thanks to the increasing consumer and corporate adoption of both.

While Adobe hasn't detailed any mitigation techniques for the vulnerability, "it seems that turning off JavaScript in Adobe Reader prevents the known samples of the exploit from running," said Qualys CTO Wolfgang Kandek.

The sticker is the "known samples" caveat. Security researchers are still studying versions of the attack found in the wild, which means that some as-yet-unseen variations may be immune to disabling JavaScript. Regardless, "we recommend turning off JavaScript in Adobe Reader and consider it a best practice for normal desktop usage," said Kandek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
FTC Opens Probe into Equifax Data Breach
Jai Vijayan, Freelance writer,  9/14/2017
Equifax CIO, CSO Step Down
Dark Reading Staff 9/15/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.