also @ TechSpot: Congress pressures Google on Glass privacy concerns

Adobe to patch zero-day Reader, Acrobat flaw January 12

By

On December 17, 2009, 8:20 AM

Adobe will reportedly patch a critical vulnerability (CVE-2009-4324) in Reader and Acrobat on January 12, the company's next scheduled quarterly security update, as opposed to an off-cycle release. The zero-day bug is currently being exploited on Reader and Acrobat versions 9.2 and earlier. If used, an attacker could crash the system and ultimately take control of it.

Thankfully, both the rate of infection and risk assessment level are very low, according to Symantec. Although an official fix is still several weeks away, users can utilize a JavaScript Blacklist mitigation feature introduced to Reader and Acrobat versions 9.2 and 8.1.7 in October, which disables access to individual JavaScript APIs.

Webroot analyzed the malware and discovered that it installs three files which resemble Windows system files, and are digitally signed with a forged Microsoft certificate. However, unlike legitimate Microsoft-signed certificates, the malware's lack an email address and timestamp.

No tags on this story

User Comments: 3

Got something to say? Post a comment
  1. That's why I don't use adobe reader....There are so many third party, free, alternatives out there.

  2. As OS's have become more secure, hackers have moved to the weakest link which appears to be Adobe. Adobe is on almost every computer, Reader, Flash, etc. so there is a big target on it. Adobe seems to have bloated software and is slow to react to these threats; hopefully they will improve things.

  3. Yep, this is a test for Adobe...as they practically have a monopoly in the market for Flash, PDF, etc. If companies get big and lazy they get targeted even more. Too bad the security fix won't be released sooner despite the lack of severity. It just doesn't show to me that they really care.

Recently commented stories

Post a new comment

Social Login & Guest Posting TechSpot Members
Login here or sign up for free,
it takes about a minute.
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.
TechSpot on:

Subscribe to TechSpot

Get free exclusive content, learn about new features and breaking tech news.