Adobe Patches Zero Day Vulnerabilities

Adobe on Thursday released out-of-cycle security updates for a vulnerability in its Reader and Acrobat software.

"The vulnerability is critical and can be used to take control of the targeted computer and should be addressed as soon as possible," said Wolfgang Kandek, chief technology officer of Qualys, in a blog post.

According to the U.S. Computer Emergency Readiness Team (US-CERT), the vulnerability stems from an "integer overflow in CoolType.dll" in Reader and Acrobat, which could allow remote attackers "to execute arbitrary code via a TrueType font with a large maxCompositePoints value in a Maximum Profile (maxp) table."

Adobe Acrobat version 9 -- up to and including 9.3.3 -- for Windows and Macintosh is vulnerable. Adobe Reader 9, up to and including version 9.3.3, for Windows, Macintosh, and Unix, and Adobe Reader 8, up to and including version 8.2.3, for Windows and Macintosh are also affected.

The underlying vulnerability was first detailed by security researcher Charlie Miller last month at the Black Hat USA 2010 conference.

Interestingly, however, Adobe gives credit for discovering the vulnerability to Tavis Ormandy. "It seems that Tavis reported the vulnerability to Adobe before Charlie's Black Hat presentation. This is an example that illustrates an effect that security researchers have long tried to call attention to: it is possible and seems to happen every once in a while that vulnerabilities are discovered independently, both by security researchers and/or malware writers," said Qualys's Kandek.

To fix the security flaws, Adobe released Adobe Reader 9.3.4, Acrobat 9.3.4, and Acrobat 8.2.4. The updates also bundle a new version of Adobe Flash Player, released earlier this month, which addressed critical vulnerabilities in Flash. It also improves on another security update released in June.

Adobe's next regularly scheduled Adobe Reader and Acrobat quarterly security update will be October 12, 2010.