Members
  • Total Members: 12814
  • Latest: Rono
Stats
  • Total Posts: 28521
  • Total Topics: 8240
  • Online Today: 924
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: Adobe patches two critical vulnerabilities in Reader  (Read 1209 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Adobe patches two critical vulnerabilities in Reader
« on: 17. November 2010., 07:11:18 »


Adobe today issued an emergency update for its popular Reader PDF software that patched two critical vulnerabilities, including one attackers have exploited for weeks.

The more notable flaw fixed in Reader 9.4.1 for Windows and Mac OS X was a bug that hackers have been leveraging since late October using malicious PDF documents. Those attacks have taken advantage of a flaw in Reader's "authplay" component. Authplay is the interpreter that renders Flash content embedded within PDF files.

Successful attacks have dropped a Trojan horse and other malware on victimized Windows PCs.

Authplay has been targeted by malware makers several times this year, most recently in June. Then, Adobe shipped an emergency patch for Flash Player within a week, and followed with a fix for Reader and Acrobat two weeks later.

Adobe followed the same general timeline this time, patching Flash Player first on Nov. 4, then Reader and Acrobat today.

Adobe has defended its two-stage patching -- which some have questioned because active authplay exploits are typically aimed at Reader, not Flash -- by explaining that the fix was first crafted by its Flash development team. The patched "authoplay.dll" file was then handed off to the Reader group to integrate and test with their product.

The second vulnerability addressed Tuesday had been disclosed on the Full Disclosure security mailing list earlier this month: http://seclists.org/fulldisclosure/2010/Nov/23
At the time, Adobe said that the flaw could be used to crash Reader, but not Acrobat, and said it was unsure whether an exploit could compromise a computer running the PDF program.

Adobe repeated that analysis today. "These updates resolve a memory corruption vulnerability that could potentially lead to code execution," the company said in an advisory accompanying the updates: http://www.adobe.com/support/security/bulletins/apsb10-28.html

Although Adobe tries to hew to a quarterly patch schedule for Reader and Acrobat, at times it's scuttled those plans to issue rush fixes for critical bugs. That wasn't the case here: Adobe made it a point to remind users that it will still release its next regularly-scheduled Reader update on Feb. 8, 2011.

Only the Windows and Mac versions of Reader and Acrobat were patched today. An updated Reader for Linux/Unix won't ship until Nov. 30. Adobe also postponed a patch for the older Adobe 8.x, which is vulnerable to the second bug.

"Adobe plans to address Adobe Reader version 8.x in the next release," the advisory read.

Neither bug affected the Android version of Reader that Adobe launched in August.

Reader was last patched Oct. 5 in a 23-fix update one security expert called a "double-whammy."

Adobe Reader and Acrobat for Windows and Mac OS X can be downloaded using the links included in Tuesday's advisory: http://www.adobe.com/support/security/bulletins/apsb10-28.html
Alternately, users can call up the programs' built-in update mechanisms to grab the new versions.

(CW)

Samker's Computer Forum - SCforum.info

Adobe patches two critical vulnerabilities in Reader
« on: 17. November 2010., 07:11:18 »




sclar61

  • SCF Member
  • **
  • Posts: 13
  • KARMA: 2
  • Gender: Male
  • to be or not to be
Re: Adobe patches two critical vulnerabilities in Reader
« Reply #1 on: 18. November 2010., 12:10:07 »
are these vulnerabilities limited to windows system, or extended to other operating systems?
we live great upheavals

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Re: Adobe patches two critical vulnerabilities in Reader
« Reply #2 on: 18. November 2010., 17:21:54 »
are these vulnerabilities limited to windows system, or extended to other operating systems?

Hi sclar61,

this vulnerabilities affect all three major OS, but "only the Windows and Mac versions of Reader and Acrobat were patched yesterday. An updated Reader for Linux/Unix won't ship until Nov. 30."

Regards,

S.

P.S.


You have detailed explanation in Topic...

 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising