Adobe Fixes 29 Flaws In Acrobat And Reader
At least one of the vulnerabilities addressed is being actively exploited.
Microsoft wasn't the only company issuing a major security patch on Tuesday.
Adobe released a fix for 29 vulnerabilities in its Acrobat and Acrobat Reader software, warning that the vulnerabilities could be exploited to cause crashes and to take control of the user's computer.
Adobe rates the update as "crtical" and warns that one of the vulnerabilities (CVE-2009-3459) is actively being exploited.
Security company Trend Micro reported last week that it had discovered a zero-day exploit making use of this vulnerability. The malware consists of a PDF file with embedded JavaScript that executes arbitrary code using a technique called heap spraying.
A successful attack results in the installation of a backdoor that provides the attacker with unrestricted user-level access.
Affected software includes Adobe Reader 9.1.3 and Acrobat 9.1.3, Adobe Reader 8.1.6 and Acrobat 8.1.6 for Windows, Macintosh and UNIX, and Adobe Reader 7.1.3 and Acrobat 7.1.3 for Windows and Macintosh.
Updated software will become version 9.2, 8.17, or 7.14.
Adobe's software has become a popular target for cyber criminals because of its broad distribution.
According to the 2009 Top Cyber Security Risks report, released in September by the SANS Institute, "'File Format Vulnerabilities' continue to be the first choice for attackers to conduct zero-day and targeted attacks. Most of the attacks continue to target Adobe PDF, Flash Player and Microsoft Office Suite (PowerPoint, Excel and Word) software."
Adobe's Acrobat and Reader software accounted for four of the top 30 vulnerabilities cited in the report, with four more spots going to Adobe's Flash software.
The most influential event about the Enterprise 2.0 movement is coming to San Francisco this fall: Enterprise 2.0 Conference Find out more and register.
About the Author
You May Also Like
Transform Your Security Operations And Move Beyond Legacy SIEM
Nov 6, 2024Unleashing AI to Assess Cyber Security Risk
Nov 12, 2024Securing Tomorrow, Today: How to Navigate Zero Trust
Nov 13, 2024The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024