Adobe has patched 23 security vulnerabilities in its Reader document viewer, including one that criminals were exploiting to install malware on the PCs of unwitting victims.
At least 18 of the other flaws also made it possible for attackers to remotely hijack users' PCs, Adobe said in an bulletin released on Tuesday:
http://www.adobe.com/support/security/bulletins/apsb10-21.html The patch updates Reader and its sister application, Acrobat, to versions 9.4 and 8.2.5.
Adobe accelerated the release of the patch after researcher Mila Parkour uncovered a sophisticated attack circulating by email that exploited a stack overflow. The exploit was notable because it bypassed defensive protections Microsoft has built into more recent versions of Windows, such as ASLR, or address space layout randomization, and DEP, or data execution prevention. (The bypass was made possible by a programming mistake on Adobe's part.)
The booby-trapped PDF files, which were sent to select individuals and company employees, also contained three separate font packages so they worked on multiple versions of the Adobe programs. To allay victims' suspicions, the malware used a stolen digital certificate to sign some of its files.
Another vulnerability addressed in Tuesday's update actually resides in code associated with the Adobe Flash Player that's embedded in Reader and Acrobat. Attackers were exploiting the flaw in Flash until Adobe squashed the bug in that application last month. There are no reports so far that it was targeted in the company's PDF software.
It's been a tough couple of years for Adobe, which by many estimates is the second most attacked software maker behind Microsoft. With its highly complex code residing in the vast majority of the world's PCs, it allows exploit writers to maximize their profits.
Adobe has responded to the attacks by designing a security sandbox for Reader and Acrobat that will separate the applications' processes from the critical functioning of the underlying operating system. Of the dozen or so real-world attacks that have exploited vulnerabilities in Reader over the past few years, none of them would have succeeded against the application had it employed the sandbox, Adobe's senior director of product security and privacy, Brad Arkin, said in July.
The feature, to be called Adobe Reader Protected Mode, will be included in the next major release of the application, which is due out before the end of the year. Adobe's Kyle Randolph released an initial round of technical details about the new design on Tuesday here:
http://blogs.adobe.com/asset/2010/10/inside-adobe-reader-protected-mode-part-1-design.htmlBuilding a sandbox into an application as complex as Reader has been compared by some to adding a basement to a 20-story building after it's already been erected. Versions 7 and 8 of Internet Explorer have a similar feature, and so does Google's Chrome browser.
Adobe's plans to follow suit shows it is making good on its promise to make its users safer. One area where the company can still improve is its warning to those updating Reader and Flash that they may need to temporarily disable their anti-virus software:
http://twicsy.com/i/eUbAr This kluge puts users at risk. It's time Adobe developers fixed it.
(ElReg)
Total Members: 14197
Topic: Adobe patch 23 security vulnerabilities in Reader (Read 4028 times)
