Attack PDF prowls for unpatched Adobe Reader, Acrobat
233877
A malicious PDF document that exploits bugs in Adobe's Reader and Acrobat software is on the loose, Symantec said Tuesday, just hours after Adobe patched the programs."This mass mailing of exploit files may be an attempt to leverage the exposure window between patch release and widespread adoption of the fix," said Symantec in a warning to customers of its DeepSight threat intelligence network.The rogue PDF document is attached to spammed e-mail and arrives with a filename like YOUR_BILL.pdf or INVOICE.pdf, said Symantec. It exploits the "mailto:" protocol vulnerability disclosed more than a month ago by U.K.-based researcher Petko Petkov.Adobe fixed the flaw Monday and released updated 8.1.1 editions of both Reader and Acrobat that plug the hole. Users of older versions of the popular programs must either upgrade to 8.1.1 or apply one of the temporary work-arounds Adobe provided to stifle attacks. On Monday, Adobe did say that it would update Adobe Reader 7.0.9 and Acrobat 7.0.9 "at a later date" but did not set a definitive timeline.When recipients open the attacking PDF, it launches a Trojan horse dubbed "Pidief.a" that knocks out the Windows firewall and then downloads another piece of malware to the compromised computer. That second piece of attack code is a dedicated downloader that can retrieve files from a remote server and, at the attacker's command, pull them onto the hacked PC."The host [server] is live and still currently serving [the downloader] over FTP," said Symantec this morning. The server is well known for hosting malicious software, the warning added.Although Adobe patched the newest versions of Reader and Acrobat, the vulnerability is ultimately Microsoft's responsibility. The software vendor owned up to that two weeks ago, saying that it would patch common protocol handlers like mailto: in Windows XP and Windows Server 2003.Only users running the Internet Explorer 7 browser on XP or Windows Server 2003 are vulnerable to the PDF exploit."[Users] are advised to apply the patches outlined in Adobe Advisory APSB07-18 as soon as possible," Symantec recommended.Computerworld is an InfoWorld affiliate
92344
Blog: The most serious involves poisoned PDF files. The update also includes patches for Bind, Fetchmail, and GNU Screen.
542850
A directory reversal within "flat" extensions could lead to system profile attacks.
35029
Unpatched vulnerabilities may leave computers open to remote attacks.
585935
Adobe Repairs Reader, Acrobat Flaws Information Week
67777
Day after Adobe patches Acrobat, Russian exploits target vulnerable systems.
603661
Acrobat 8 line, due in November, will allow people to view a common PDF file via a Web browser.
748053
Attackers have been exploiting a recently-revealed flaw in Adobe Reader since at least Jan. 20, with one security researcher estimating that "many thousands" of computers have been infected so far.
22385
Directory transversal shocker A scripting error in Adobe's website gave outsiders broad access to internal files on the company's webserver that could prove valuable to malicious hackers trying to penetrate its security.â¦
152057
More dodgy upgrade madness A faulty signature update from GRISoft published this week meant that its popular AVG anti-virus package falsely warned versions of Adobe Reader were infected with a Trojan.â¦
314823
No end to the madness in sight Hackers have released an exploit targeting a third unpatched vulnerability in Microsoft Word. The flaw is different from the two previous Word vulnerabilities reported earlier this month, US CERT helpfully explains.â¦
614089
Adobe is providing some new collaboration tools with the release of its Acrobat 8 upgrade. The PDF pioneer also released Acrobat Connect today, a new product line that enables users to conduct Web conferences through online meeting rooms using Flash Player software.
149501
A malicious PDF document that exploits bugs in Adobe Systems' Reader and Acrobat software is on the loose, Symantec said, just hours after Adobe patched the programs.
156986
The flaws disclosed last week in Adobe System&#39;s Reader and Acrobat programs have been used to exploit computers since at least January via malicious banner advertisements, security analysts are reporting.Adobe issued patches&#160;last Wednesday for Reader and Acrobat, but the company did not detail the flaws.Problems with Adobe&#39;s software can potentially affect millions of PC users, since the company&#39;s software is widely used to read PDF (Portable Document Format) files. Most people regard PDFs as harmless.&quot;From our standpoint, it appears that this PDF-based attack has been quite successful, affecting many thousands of users throughout the world,&quot; wrote Hon Lau on Symantec&#39;s Security Response Weblog.Greg McManus of iDefense Labs, the security arm of VeriSign, reported one of the vulnerabilities to Adobe in October, according to a post by the SANS Institute, a computer security organization.Since hackers have been apparently using the Adobe flaws since January, it raises the question how they discovered the flaw.Lau wrote that the &quot;swiftness of the exploit appearing in the wild suggests that leaks had occurred.&quot;However, it appears that the vulnerabilities in Reader and Acrobat were disclosed in a responsible way, Lau wrote.The flaws in the programs allow a hacker to create a malicious PDF document. If opened by a victim, that document downloads a malicious Trojan that Symantec calls &quot;Zonebac.&quot;Zonebac was first detected in 2006. It shuts off a user&#39;s security software as well as downloads other bad software. The latest version also appears to taint search engine results, Lau wrote.In January, iDefense noticed that the malicious PDF document was being delivered through malicious banner advertisements. Symantec&#39;s Lau wrote that it&#39;s not immediately clear how the PDF file is delivered, but that the banner ads could be redirecting people to other harmful Web sites with the file. Also, spam messages may be carrying the bad file as an attachment.Malicious banner ads can be particularly dangerous since the ads can show up on legitimate Web sites. Online advertising companies have struggled to keep these ads off their networks. Sometimes, hackers will approach the networks with what is a legitimate ad and then substitute it for a malicious one. Many of those bad ads have exploited vulnerabilities in Adobe&#39;s Flash multimedia technology.Adobe&#39;s Reader and Acrobat are designed to regularly look for updates, but users are advised to upgrade to the patched version, 8.1.2.&#160;
676591
Ziff Davis - Holes in KOffice and RealPlayer allow attackers to take over a user's system.
216602
Yahoo may glow in the halo effect of the popular Adobe Acrobat Reader, installed on more than 500 million computers. At 274 million users, Yahoo will leverage the partnership to try to oust
475141
Adobe on Monday introduced version 8 of its ubiquitous Acrobat PDF software as part of a minor update to its Creative Suite. The new release brings with it Web conferencing functionality incorporated from Macromedia Breeze.