Adobe Rushes Out Emergency Patches For Critical Bugs

Engineers at Adobe Systems have been busy after the company released patches to plug 17 critical security holes affecting Adobe Reader and Acrobat.

Zero Day Vulnerability

Among the fixes is a patch for a zero-day vulnerability that impacted not only Reader and Acrobat, but versions of Adobe Flash Player as well, on multiple operating systems. Earlier in June, attackers were seen using the bug to plant backdoor Trojans on vulnerable machines.

Also among the bevy of patches is a fix for a situation demonstrated by security researcher Didier Stevens earlier in 2010, in which a PDF reader’s “/launch” command could be abused to run malicious embedded executables.

“[The June 29] update includes changes to resolve the misuse of this command,” blogged Steve Gottwals, group product manager for Adobe Reader. “We added functionality to block any attempts to launch an executable or other harmful objects by default. We also altered the way the existing warning dialog works to thwart the known social engineering attacks.”

When the feature is enabled, the user will get a warning message when opening attachments.

Open To Hackers

Almost all the vulnerabilities are known to leave users open to arbitrary code execution. The one exception is CVE-2010-2204, a remote memory corruption vulnerability that can cause programs to crash.

According to Adobe, arbitrary code execution has not been demonstrated, but may be possible.

Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

Recent Posts

Craig Wright Sentenced For Contempt Of Court

Suspended prison sentence for Craig Wright for “flagrant breach” of court order, after his false…

3 days ago

El Salvador To Sell Or Discontinue Bitcoin Wallet, After IMF Deal

Cash-strapped south American country agrees to sell or discontinue its national Bitcoin wallet after signing…

3 days ago

UK’s ICO Labels Google ‘Irresponsible’ For Tracking Change

Google's change will allow advertisers to track customers' digital “fingerprints”, but UK data protection watchdog…

3 days ago

EU Publishes iOS Interoperability Plans

European Commission publishes preliminary instructions to Apple on how to open up iOS to rivals,…

4 days ago

Momeni Convicted In Bob Lee Murder

San Francisco jury finds Nima Momeni guilty of second-degree murder of Cash App founder Bob…

4 days ago