News

UPDATE: Adobe Patches Reader Flaw

Adobe Systems on Wednesday said it has released a patch to stave off stack buffer overflow exploits in its free and widely used Adobe Reader software.

The patch comes after security researcher Core Security Technologies put out an advisory Tuesday disclosing a vulnerability that it said could have adverse effects on millions of individuals and businesses who use the popular application, which enables users to view PDF files. The CoreLabs engineers discovered attackers could exploit Adobe Reader to gain access to vulnerable systems by using a maliciously crafted PDF file.

Only the older versions of Acrobat and Reader, such as version 8.1.2, are affected by the vulnerability; Acrobat 9 and Reader 9 are unaffected.

Andrew Storms, director of security at nCircle, lauded Adobe's quick response time, saying that the threat presented "a significant risk to the enterprise as Adobe PDF files are a mainstay for corporate communications."

Once implemented, the patch will take effect automatically once users restart Adobe Reader. In the event that this installation doesn't take, a manual update can be made by clicking on the Help tab in Windows programs and scrolling to the "checking for updates" function.

As early as May, CoreLabs notified Adobe about what it called serious vulnerabilities in the Adobe Acrobat and Adobe Reader apps. Tuesday's flaw was a rare discovery.

Until this week, Storms said users were "not as aware of the potential security risks associated with Adobe files as compared to Microsoft Word or Excel." Users have been told numerous times not to open e-mail attachments with Word and Excel files, but that awareness doesn't always extend to Adobe files, he said.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • 2021 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Microsoft Lets Orgs Test Their AI Systems by Attacking Them

    Microsoft has released an open source tool that lets organizations use attack-testing methods on their artificial intelligence (AI) software solutions.

  • With Support Winding Down, Microsoft Again Nudges Skype Users Toward Teams

    Microsoft has issued yet another warning to organizations still using Skype for Business Online, reminding them that support for the product will end on July 31, 2021.

  • The 2021 Microsoft Product Roadmap

    From Windows 10X to the next generation of Microsoft's application server products, here are the product milestones coming down the pipeline in 2021.