News

Adobe Issues Security Patches for Illustrator

Adobe Systems released security patches for its Adobe Illustrator CS4 and CS3 programs on Thursday.

The patches provide updates for Illustrator versions running on both Windows and Mac operating systems. Left unpatched, systems could be subject to "arbitrary code execution," according to Adobe's description of the problem.

Adobe closed 2009 with a zero-day Acrobat Reader bug and the company appears to be starting 2010 by addressing continuing security issues, according to Andrew Storms, director of security at nCircle.

"The first patch of the year is more of what we saw from Adobe in 2009," Storms said. "The most important patch is for a critical zero-day bug in their PDF reader that has already seen large- and small-scale exploits. Security teams everywhere are holding their breath for this one because the number of attacks has been steadily increasing over the last few weeks."

If a recent "2010 Threat Predictions" document from antivirus software maker McAfee is any indication, there will be more of the same to expect from Adobe this year. (The report, ironically, is available via this PDF.)

McAfee claims in the report that Adobe's Acrobat Reader and Flash applications will likely surpass Microsoft Office apps as favorite vectors for hackers using maliciously-coded documents to snare users in 2010.

Adobe faces a sort of "Catch-22" on security with the use of JavaScript, Storms suggested.

"One of the reasons these exploits are so effective is that the only mitigation solution is to turn off JavaScript but doing this cripples product functionality," Storms said. "Attackers know a patch is coming and are working hard to get as much out of their exploits as possible. The Adobe install base is so huge, the window for attack will likely stay open for quite a while, even after the patch is released."

Storms added that Adobe is also expected to release a handful of other patches for bugs that haven't yet been publicly announced.

"It's only January and it already looks like a tough security year for Adobe," he said.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.

  • Report: Security Initiatives Can't Keep Pace with Cloud, AI Boom

    The increasingly fast adoption of hybrid, multicloud, and AI systems is easily outgrowing existing security measures, according to a recent global survey by the Cloud Security Alliance (CSA) and exposure management firm Tenable.

  • World Map Image

    Microsoft Taps Nebius in $17B AI Infrastructure Deal To Alleviate Cloud Strain

    Microsoft has signed a five-year, $17.4 billion agreement with Amsterdam-based Nebius Group to expand its AI computing capabilities through third-party GPU infrastructure.