Adobe Moves to Fix Reported Vulnerabilities in Acrobat and Reader

By Larry Seltzer  |  Posted 2009-04-29 Print this article Print

A quick response to public posting of a vulnerability shows a better attitude at Adobe. Even so, there are two dangerous unpatched vulnerabilities to worry about.

Adobe has announced in its Product Security Incident Response Team blog that it has confirmed reports of a new vulnerability in all currently supported versions of Reader on all supported platforms. It states that the vulnerability also affects Acrobat and that it will now develop fixes for all affected products.

The vulnerability was reported on SecurityFocus and called "Adobe Reader 'getAnnots()' Javascript Function Remote Code Execution Vulnerability." The report includes proof-of-concept code for the exploit and states that the researcher who found it, code-named 'Arr1val,' tested it only on Linux. Adobe states that Acrobat and Reader versions 9.1, 8.1.4, and 7.1.1 are all affected and will be updated. Earlier versions are affected as well. Updates will be provided for Windows, Mac and UNIX.

The workaround provided by Adobe is to disable JavaScript in the Reader or Acrobat by following these instructions:

  1. Launch Acrobat or Adobe Reader.
  2. Select Edit>Preferences
  3. Select the JavaScript Category
  4. Uncheck the -Enable Acrobat JavaScript' option
  5. Click OK
Adobe will also work with anti-virus vendors to help them detect exploits of this problem. There are no reports of exploits in the wild, but proof-of-concept code is out there and malicious PDFs are not uncommon in the wild.

Another report was filed on SecurityFocus shortly thereafter by the same 'Arr1val.' Adobe says it is investigating this report. That report, "Adobe Reader 'spell.customDictionaryOpen()' JavaScript Function Remote Code Execution Vulnerability," was similar to the other one with similar exploit code.

In addition to the PSIRT blog, Adobe will be posting information about updates on this to its Security Bulletins and Advisories page.

Adobe's response to this issue shows an impressive attitude change over its behavior just a few months ago. Its sluggish response to what came to be known as the JBIG2Decode bug brought criticism from the security community both for Adobe's lack of response and help for its customers and for a very slow patch schedule.

We don't know how quickly Adobe will patch these problems, but it certainly seems as if it is taking the communications aspects of vulnerability response seriously, and that's a good sign.

Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. 

Larry Seltzer has been writing software for and English about computers ever since—,much to his own amazement—,he graduated from the University of Pennsylvania in 1983.

He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.

For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.

In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.

Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel