Adobe warns of critical vulnerability in Reader, Acrobat
Bad news for anyone that utilizes Adobe's Acrobat software, or Adobe reader to view PDF files. A critical vulnerability has been identified that can cause the applications to crash and allow an attacker to control the affected system. All versions from 7 forward on all operating systems are suspected to be at risk.
According to the announcement from Adobe, this isn't just a possibility, it's actually happening. Reports have already been made of the buffer overflow exploit being used in this type of attack. Adobe is also working with antivirus vendors to patch the holes, and patches to update the vulnerable apps are in the works. The bad news: patches aren't likely to be ready until March 11th, 2009.
That's not nearly fast enough considering the severity of the flaw. In the meantime, you'd be wise to install an alternative applications to handle viewing PDF files. Sumatra and FoxIt are both good alternatives for Windows.
The announcement doesn't specify whether the flaw is platform specific, so Mac users may want to play it safe and stick to using Preview. *nix is also at risk, though most users are likely already utilizing alternatives.
The full bulletin is available on Adobe's web site.
According to the announcement from Adobe, this isn't just a possibility, it's actually happening. Reports have already been made of the buffer overflow exploit being used in this type of attack. Adobe is also working with antivirus vendors to patch the holes, and patches to update the vulnerable apps are in the works. The bad news: patches aren't likely to be ready until March 11th, 2009.
That's not nearly fast enough considering the severity of the flaw. In the meantime, you'd be wise to install an alternative applications to handle viewing PDF files. Sumatra and FoxIt are both good alternatives for Windows.
The announcement doesn't specify whether the flaw is platform specific, so Mac users may want to play it safe and stick to using Preview. *nix is also at risk, though most users are likely already utilizing alternatives.
The full bulletin is available on Adobe's web site.













Comments
11
Subscribe to commentsBrianFeb 20th 2009 8:13AM
wow folks, if you are using Adobe Reader you deserve this attack.
Foxit ftw.
DanielFeb 20th 2009 8:37AM
I use Foxit Reader and that works perfectly well - its both faster and smallen then Adobe Reader - and does the same job!
MikeFeb 20th 2009 8:51AM
I have switched our company over to Foxit last year just because of vulnerabilities like this. They like Foxit because it's considerably faster and if you pay for the Pro version allows you to go in and edit. However, for whatever reason we still have some companies that their downloads from their websites will only open with Adobe, which REALLY frustrates me. We can't ever seem to have all the security we really need. Makes life difficult. Hate the Adobe.
KenFeb 20th 2009 9:10AM
actually the security bulletin says "all platforms" - right above the summary
D WFeb 20th 2009 9:21AM
Why would Mac users need to install anything? When you open any PDF that wasn't created on your own Mac with Acrobat, it defaults to opening the document in Preview - something that comes with Mac OS X.
MaggieFeb 20th 2009 9:43AM
It doesn't appear that PDF X-Change actually works on a Mac... Maybe I missed the right link. Any other suggestions?
ThomasFeb 20th 2009 10:00AM
Is it advised that we remove Adobe or just make certain the new program is the default?
CameronFeb 20th 2009 10:49AM
Just got hit by this last week, on Demonoid of all places. Nasty.
Unfortunately if your a designer, and your making PDF's for clients, you kind of have to have Reader installed. :(
AbscissaFeb 21st 2009 12:41AM
I was going to make a crack about how crappy Acrobat Reader 7+ has always been and then mention my use of FoxIt. But I see I've been beaten to it by three other people. Normally that sort of thing would be mildly frustrating, but in this case it brings a big smile to my face :)
bcantoniFeb 21st 2009 1:14PM
I'm also a big fan of FoxIt. In cases where I have a PDF file that it won't open, I forward it to the FoxIt development team. They aren't always able to fix the problem, but appreciate having those types of files sent in.
DoranwenMar 17th 2009 12:03PM
Hehe, I didn't even install Adobe Acrobat the last time I reloaded Windows on my laptop. Foxit only!
On a similar note, some of the teachers at the school where I'm student teaching were trying to enter info into some pdf form for an evaluation. Adobe actually told them they could not save the info or anything. I opened the pdfs with Foxit and not one bit of problem. Could save, export form data, etc. So Foxit really saved the day there. Now they all have Foxit on their laptops, and though they're still using Adobe for most things, I have hopes that they will decide to switch completely since Foxit did the trick when Adobe wouldn't . . .