Adobe Moves to Fix Reported Vulnerabilities in Acrobat and Reader

Adobe has announced in its Product Security Incident Response Team blog that it has confirmed reports of a new vulnerability in all currently supported versions of Reader on all supported platforms. It states that the vulnerability also affects Acrobat and that it will now develop fixes for all affected products.

The vulnerability was reported on SecurityFocus and called “Adobe Reader ‘getAnnots()’ Javascript Function Remote Code Execution Vulnerability.” The report includes proof-of-concept code for the exploit and states that the researcher who found it, code-named ‘Arr1val,’ tested it only on Linux. Adobe states that Acrobat and Reader versions 9.1, 8.1.4, and 7.1.1 are all affected and will be updated. Earlier versions are affected as well. Updates will be provided for Windows, Mac and UNIX.

The workaround provided by Adobe is to disable JavaScript in the Reader or Acrobat by following these instructions:

1. Launch Acrobat or Adobe Reader.
2. Select Edit>Preferences
3. Select the JavaScript Category
4. Uncheck the -Enable Acrobat JavaScript’ option
5. Click OK

Adobe will also work with anti-virus vendors to help them detect exploits of this problem. There are no reports of exploits in the wild, but proof-of-concept code is out there and malicious PDFs are not uncommon in the wild.

Another report was filed on SecurityFocus shortly thereafter by the same ‘Arr1val.’ Adobe says it is investigating this report. That report, “Adobe Reader ‘spell.customDictionaryOpen()’ JavaScript Function Remote Code Execution Vulnerability,” was similar to the other one with similar exploit code.

In addition to the PSIRT blog, Adobe will be posting information about updates on this to its Security Bulletins and Advisories page.

Adobe’s response to this issue shows an impressive attitude change over its behavior just a few months ago. Its sluggish response to what came to be known as the JBIG2Decode bug brought criticism from the security community both for Adobe’s lack of response and help for its customers and for a very slow patch schedule.

We don’t know how quickly Adobe will patch these problems, but it certainly seems as if it is taking the communications aspects of vulnerability response seriously, and that’s a good sign.

Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983.