News

EMET Wards Off Adobe Exploits, Microsoft Says

Microsoft is heralding its newly released Enhanced Mitigation Experience Toolkit (EMET) 2.0 as a fail-safe against hacker incursion methods.

The company even suggested in this blog post late last week that EMET could help stave off recent attacks associated with Adobe Systems Inc.'s software, specifically Adobe Reader and Adobe Acrobat running on Windows systems. Adobe has issued a security advisory (APSA10-02) regarding a new "critical" vulnerability in Adobe Reader 9.3.4 (and earlier versions) on Windows, Macintosh and Unix. The security advisory also covers Adobe Acrobat 9.3.4 (and earlier versions) on Windows and Macintosh.

The exploit apparently uses a hacker code-writing approach called Return Oriented Programming. This technique is used to bypass the Data Execution Prevention protection feature in Windows.

The good news, wrote Fermin Serna and Andrew Roths (two engineers with the Microsoft Security Response Center), is that if users have EMET enabled, the flaws in Adobe's Reader and Acrobat software can be headed off at the pass. Normally, Address Space Layout Randomization (ASLR) would help prevent such exploits. However, Adobe products are shipped with a Dynamic Link Library (DLL) configuration that doesn't have ASLR enabled, Microsoft's security engineers explained.

Adobe this week announced they will be releasing a patch for this security flaw during the week of Oct. 4, 2010. The release will be in advance of Adobe's regular quarterly patch schedule to meet the threat.

"This security bulletin will address a vulnerability affecting Adobe Reader and Acrobat that is currently being exploited in the wild," explained Jason Miller, data and security team manager at Shavlik Technologies.

Additionally, Adobe this week announced a new security advisory (APSA10-03) describing the same critical vulnerability in Adobe Flash Player. This vulnerability is being "exploited in the wild," according to Adobe. The advisory applies to Adobe Flash Player 10.1.82.76 (and earlier versions) for Windows, Linux, Macintosh and Solaris. It also applies to Adobe Flash Player 10.1.92.10 76 (and earlier versions) for Android. The patch is expected to be available during the week of Sept. 27.

As for the Microsoft EMET solution, it's important to note that the workarounds described by Microsoft's Serna and Roths only work on Windows 7, Vista and Windows Server 2008.

As for protecting against the Acrobat/Reader exploit on Windows XP and Server 2003, EMET's export address table access filtering mitigation also works, if nominally, to remediate the issue through the Windows Kernel32.DLL's export address table.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • The 2020 Microsoft Product Roadmap

    From the next major update to Windows 10 to the next generations of .NET and PowerShell, here's what's on tap from Microsoft this year.

  • Version 20H2 of Windows 10 and Windows Server Released

    The October 2020 updates of Windows 10 and Windows Server, also known as version 20H2, were released by Microsoft on Tuesday.

  • Phishing Attacks Impersonate Microsoft's Brand the Most

    Security solutions firm Check Point this week gave Microsoft the dubious distinction of being the "most imitated" company used for phishing attacks.

  • Remote Work To Drive Higher Cloud, IT Services Spending in 2021

    Global tech spending has taken a hit in 2020 due to the COVID-19 pandemic, but analysts expect it to rebound next year.