News

EMET Wards Off Adobe Exploits, Microsoft Says

Microsoft is heralding its newly released Enhanced Mitigation Experience Toolkit (EMET) 2.0 as a fail-safe against hacker incursion methods.

The company even suggested in this blog post late last week that EMET could help stave off recent attacks associated with Adobe Systems Inc.'s software, specifically Adobe Reader and Adobe Acrobat running on Windows systems. Adobe has issued a security advisory (APSA10-02) regarding a new "critical" vulnerability in Adobe Reader 9.3.4 (and earlier versions) on Windows, Macintosh and Unix. The security advisory also covers Adobe Acrobat 9.3.4 (and earlier versions) on Windows and Macintosh.

The exploit apparently uses a hacker code-writing approach called Return Oriented Programming. This technique is used to bypass the Data Execution Prevention protection feature in Windows.

The good news, wrote Fermin Serna and Andrew Roths (two engineers with the Microsoft Security Response Center), is that if users have EMET enabled, the flaws in Adobe's Reader and Acrobat software can be headed off at the pass. Normally, Address Space Layout Randomization (ASLR) would help prevent such exploits. However, Adobe products are shipped with a Dynamic Link Library (DLL) configuration that doesn't have ASLR enabled, Microsoft's security engineers explained.

Adobe this week announced they will be releasing a patch for this security flaw during the week of Oct. 4, 2010. The release will be in advance of Adobe's regular quarterly patch schedule to meet the threat.

"This security bulletin will address a vulnerability affecting Adobe Reader and Acrobat that is currently being exploited in the wild," explained Jason Miller, data and security team manager at Shavlik Technologies.

Additionally, Adobe this week announced a new security advisory (APSA10-03) describing the same critical vulnerability in Adobe Flash Player. This vulnerability is being "exploited in the wild," according to Adobe. The advisory applies to Adobe Flash Player 10.1.82.76 (and earlier versions) for Windows, Linux, Macintosh and Solaris. It also applies to Adobe Flash Player 10.1.92.10 76 (and earlier versions) for Android. The patch is expected to be available during the week of Sept. 27.

As for the Microsoft EMET solution, it's important to note that the workarounds described by Microsoft's Serna and Roths only work on Windows 7, Vista and Windows Server 2008.

As for protecting against the Acrobat/Reader exploit on Windows XP and Server 2003, EMET's export address table access filtering mitigation also works, if nominally, to remediate the issue through the Windows Kernel32.DLL's export address table.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Report: Cost, Sustainability Drive DaaS Adoption Beyond Remote Work

    Gartner's 2025 Magic Quadrant for Desktop as a Service reveals that while secure remote access remains a key driver of DaaS adoption, a growing number of deployments now focus on broader efficiency goals.

  • Windows 365 Reserve, Microsoft's Cloud PC Rental Service, Hits Preview

    Microsoft has launched a limited public preview of its new "Windows 365 Reserve" service, which lets organizations rent cloud PC instances in the event their Windows devices are stolen, lost or damaged.

  • Hands-On AI Skills Now Outshine Certs in Salary Stakes

    For AI-related roles, employers are prioritizing verifiable, hands-on abilities over framed certificates -- and they're paying a premium for it.

  • Roadblocks in Enterprise AI: Data and Skills Shortfalls Could Cost Millions

    Businesses risk losing up to $87 million a year if they fail to catch up with AI innovation, according to the Couchbase FY 2026 CIO AI Survey released this month.