News

Adobe's Reader Fix: Disable JavaScript, For Now

Adobe Systems Inc. confirmed this week that it's looking into chatter that its PDF viewing software, Adobe Reader, contains a critical vulnerability. IT security experts are mixed on the urgency of the patch, mainly because the application isn't mission-critical, but also because of cumbersome programming concerns and frequent problems with the application.

"All currently supported shipping versions of Adobe Reader and Acrobat, [Versions] 9.1, 8.1.4 and 7.1.1 and earlier, are vulnerable to this issue," said David Lenoe, the company's security program manager, in a blog entry. Lenoe was referring to a bug in Adobe's implementation of JavaScript that became public knowledge ealier in the week.

Disabling JavaScript is seen by security experts as a mitigating control for the vulnerability. The issue came about after a researcher from Securityfocus said that the bug is another in a long line of flaws in Adobe's implementation of the popular programming language.

"Adobe does deserve a hat tip this week for their quick confirmation of mitigation steps for their latest zero-day bug," said Andrew Storms, director of security for nCircle. "The reality, though, is that attempting to disable JavaScript on thousands of end points at any large enterprise is a huge time sink that hampers functionality."

Storms and other security experts contend that Adobe's patch release behavior is a lot like Microsoft's model was a decade ago, before Microsoft organized its monthly event and rolled out fixes in a more structured way.

"Like Microsoft used to be, Adobe now has a situation where there is continuous batches of publicly known vulnerabilities, minimal mitigation assistance and no known patch release date," Storms said. "Together, these factors make it hard for security teams to see the light at the end of the tunnel."

Indeed, Adobe's frequent sporadic disclosure of vulnerabilities and patches give the impression that it doesn't yet have a formal setup to react to security flaws, without going through normal product cycles.

Adobe's challenges are two-fold going forward. First off, administrators don't necessarily want to disable JavaScript in an environment where the Web is prominent. As well, Adobe frequently discloses information, sometimes without giving IT pros a chance to respond.

"The more frequently a vendor releases patches, the more lax a customer may get," said Eric Schultze, CTO, Shavlik Technologies. "Why should I install a new version of XYZ software today, when in two weeks I'll only have to reinstall a newer version? While it's great that they fix items as they're found, a high level of frequent releases can lead to a high level of installation apathy."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Microsoft Appoints Althoff as New CEO for Commercial Business

    Microsoft CEO and chairman Satya Nadella on Wednesday announced the promotion of Judson Althoff to CEO of the company's commercial business, presenting the move as a response to the dramatic industrywide shifts caused by AI.

  • Broadcom Revamps VMware Partner Program Again

    Broadcom recently announced a significant update regarding its VMware Cloud Service Provider (VCSP) program, coinciding with the release of VMware Cloud Foundation (VCF) 9.0, a key component in Broadcom’s private cloud strategy.

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.