Members
  • Total Members: 12816
  • Latest: t114563
Stats
  • Total Posts: 28524
  • Total Topics: 8240
  • Online Today: 815
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: Adobe patch 23 security vulnerabilities in Reader  (Read 1826 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Adobe patch 23 security vulnerabilities in Reader
« on: 07. October 2010., 07:13:59 »


Adobe has patched 23 security vulnerabilities in its Reader document viewer, including one that criminals were exploiting to install malware on the PCs of unwitting victims.

At least 18 of the other flaws also made it possible for attackers to remotely hijack users' PCs, Adobe said in an bulletin released on Tuesday: http://www.adobe.com/support/security/bulletins/apsb10-21.html
The patch updates Reader and its sister application, Acrobat, to versions 9.4 and 8.2.5.

Adobe accelerated the release of the patch after researcher Mila Parkour uncovered a sophisticated attack circulating by email that exploited a stack overflow. The exploit was notable because it bypassed defensive protections Microsoft has built into more recent versions of Windows, such as ASLR, or address space layout randomization, and DEP, or data execution prevention. (The bypass was made possible by a programming mistake on Adobe's part.)

The booby-trapped PDF files, which were sent to select individuals and company employees, also contained three separate font packages so they worked on multiple versions of the Adobe programs. To allay victims' suspicions, the malware used a stolen digital certificate to sign some of its files.

Another vulnerability addressed in Tuesday's update actually resides in code associated with the Adobe Flash Player that's embedded in Reader and Acrobat. Attackers were exploiting the flaw in Flash until Adobe squashed the bug in that application last month. There are no reports so far that it was targeted in the company's PDF software.

It's been a tough couple of years for Adobe, which by many estimates is the second most attacked software maker behind Microsoft. With its highly complex code residing in the vast majority of the world's PCs, it allows exploit writers to maximize their profits.

Adobe has responded to the attacks by designing a security sandbox for Reader and Acrobat that will separate the applications' processes from the critical functioning of the underlying operating system. Of the dozen or so real-world attacks that have exploited vulnerabilities in Reader over the past few years, none of them would have succeeded against the application had it employed the sandbox, Adobe's senior director of product security and privacy, Brad Arkin, said in July.

The feature, to be called Adobe Reader Protected Mode, will be included in the next major release of the application, which is due out before the end of the year. Adobe's Kyle Randolph released an initial round of technical details about the new design on Tuesday here: http://blogs.adobe.com/asset/2010/10/inside-adobe-reader-protected-mode-part-1-design.html

Building a sandbox into an application as complex as Reader has been compared by some to adding a basement to a 20-story building after it's already been erected. Versions 7 and 8 of Internet Explorer have a similar feature, and so does Google's Chrome browser.

Adobe's plans to follow suit shows it is making good on its promise to make its users safer. One area where the company can still improve is its warning to those updating Reader and Flash that they may need to temporarily disable their anti-virus software: http://twicsy.com/i/eUbAr
This kluge puts users at risk. It's time Adobe developers fixed it.

(ElReg)

Samker's Computer Forum - SCforum.info

Adobe patch 23 security vulnerabilities in Reader
« on: 07. October 2010., 07:13:59 »




mercenary

  • SCF Member
  • **
  • Posts: 27
  • KARMA: 3
Re: Adobe patch 23 security vulnerabilities in Reader
« Reply #1 on: 07. October 2010., 15:11:46 »
How does everyone handle adobe in their corp IT worlds...  just not install it force users to patch it? 

dss2010

  • SCF Newbie
  • *
  • Posts: 5
  • KARMA: 3
    • Desktop Security Software
Re: Adobe patch 23 security vulnerabilities in Reader
« Reply #2 on: 08. October 2010., 03:44:01 »
This was a security issue I was following.  Thanks for posting the update here  ;D
I think the updates came even faster than they were originally planned!
Learn more about desktop security software and stay aware and prepared.
Or follow me on Twitter =)

GT

  • SCF Newbie
  • *
  • Posts: 3
  • KARMA: 2
Re: Adobe patch 23 security vulnerabilities in Reader
« Reply #3 on: 09. October 2010., 05:18:15 »
what you suggest to use Adobe or not?

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Foxit Reader alternative for Adobe Reader
« Reply #4 on: 09. October 2010., 05:53:24 »
what you suggest to use Adobe or not?

You "need" some application to open "pdf" documents... ;) simply regularly check and install latest updates for Adobe products.

Additionally, you have alternative (also good) products, like Foxit Reader for exmple: http://www.foxitsoftware.com/pdf/reader/


 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising