Bugs Bring New Dangers to Acrobat Users

Adobe Systems Inc. has warned of two serious security flaws affecting Windows, Mac OS X and Unix versions of its Acrobat software. The bugs could allow an attacker to execute malicious code on a users system via a PDF file distributed via e-mail, according to security researchers.

The first flaw affects Version 6.0.2 of Acrobat Reader, according to an advisory posted to the Bugtraq mailing list by security research firm iDefense, which discovered both bugs. Reader incorrectly parses the .etd files used in eBook transactions so that an .etd file containing special code in the "title" or "baseurl" fields can cause an invalid memory access.

Adobe bolsters Reader in Version 7.0. Click here to read more.

This could allow the execution of malicious code with the privileges of the user, iDefense said. An attacker could exploit this bug by sending an e-mail message including either an attached PDF file or a link to the file.

Earlier versions of Acrobat Reader 6 may also be vulnerable, and Adobe Acrobat may also be affected, iDefense said. Adobe has released Version 6.0.3 of both Acrobat and Reader for the Windows and Mac OS X platforms, which fixes the problem.

iDefense said users can also protect themselves by deleting the file: "C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\eBook.api." This doesnt affect the handling of PDF files, but wont allow Acrobat or Reader to handle eBooks.

Resource Library:

If Adobe had its way, PDF would become the standard of corporate document management. Click here to read David Courseys column.

A separate flaw has a similar effect on Reader Version 5.0.9 for Unix, iDefense said. This flaw is found in Readers e-mail function, mailListIsPdf, and can be exploited in the same way as the eBook bug. Adobe made it clear it isnt aware of any attempts to exploit the flaw, but recommended that users update to the newly released Acrobat Reader 5.0.10 "as a precaution."

iDefense added that previous versions of Reader 5 for Unix are probably vulnerable. The company said Unix users can get additional protection from an unofficial patch for the acroread shell script, which adds a check ensuring that files passed to acroread are in fact PDF documents. The patch doesnt protect against files opened manually from within Reader, iDefense said.

Secunia, an independent security researcher that maintains a vulnerabilities database, gave the Unix flaw a "highly critical" rating. Both bugs were discovered in mid-October, iDefense said.

For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzers Weblog.