News
UPDATE: Adobe Patches Reader Flaw
- By Jabulani Leffall
- November 05, 2008
Adobe Systems on Wednesday said it has released a
patch
to stave off
stack
buffer overflow exploits in its free and widely used Adobe Reader software.
The patch comes after security researcher Core Security Technologies put out
an advisory Tuesday disclosing a vulnerability that it said could have adverse
effects on millions of individuals and businesses who use the popular application,
which enables users to view PDF files. The CoreLabs engineers discovered attackers
could exploit Adobe Reader to gain access to vulnerable systems by using a maliciously
crafted PDF file.
Only the older versions of Acrobat and Reader, such as version 8.1.2, are affected
by the vulnerability; Acrobat 9 and Reader 9 are unaffected.
Andrew Storms, director of security at nCircle, lauded Adobe's quick response
time, saying that the threat presented "a significant risk to the enterprise
as Adobe PDF files are a mainstay for corporate communications."
Once implemented, the patch will take effect automatically once users restart Adobe Reader. In the event that this installation doesn't
take, a manual update can be made by clicking on the Help tab in Windows programs
and scrolling to the "checking for updates" function.
As early as May, CoreLabs notified Adobe about what it called serious vulnerabilities
in the Adobe Acrobat and Adobe Reader apps. Tuesday's flaw was a rare discovery.
Until this week, Storms said users were "not as aware of the potential security
risks associated with Adobe files as compared to Microsoft Word or Excel." Users
have been told numerous times not to open e-mail attachments with Word and Excel
files, but that awareness doesn't always extend to Adobe files, he said.
About the Author
Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.