Web Security News

Adobe promises Reader, Acrobat patches for Tuesday

Thursday, May 7, 2009

Adobe last week promised to patch the zero-day vulnerability in its Adobe Reader and Acrobat software no later than Tuesday, acknowledging the security bugs in a post on the Adobe product security response blog.

On Friday, Adobe's security team said it would issue updates to Adobe Reader and Acrobat versions 7, 8 and 9 for Windows and versions 8 and 9 for Mac and Linux.

"We are in the process of fixing the issue," which said David Lenoe, the company's security program manager, in a blog post. "Additionally, we have confirmed the second vulnerability (CVE-2009-1493) for Adobe Reader for Unix."

"This issue will be resolved in the upcoming Adobe Reader for Unix updates," the post said. "Currently, we have not been able to reproduce an exploitable scenario for Windows and Macintosh, but we will continue to investigate."

The Adobe Reader and Acrobat problem involves possible exploits of JavaScript which allow remote attackers to cause a denial of service or execute arbitrary code via a PDF file.

Proof-of-concept exploit code for both flaws has been circulating the web, according to eWeek. Adobe said it is not aware of any attacks, the website reported.

Users are advised to disable JavaScript in Reader and Acrobat until the patch available.
ADNFCR-1765-ID-19158441-ADNFCR

Related News:

Mac OS X malware game Lose-Lose deletes files - 11.5.2009
A graduate student has written a game for Mac OS X that resembles the classic video game Space Invaders, but Mac users should not download the game if they don't want to have it randomly delete files.

Adobe issues critical security update for Shockwave Player - 11.5.2009
Adobe Systems yesterday released a critical update for all versions of Shockwave Player and recommends that users upgrade to version 11.5.2.602 to protect against cyber attacks exploiting the vulnerability.

Microsoft Security Essentials detects malware that kills Windows XP - 11.5.2009
A new Trojan malware detected by Microsoft Security Essentials as Win32/Daonol steals credential information and redirects web traffic, Microsoft said on its malware protection blog.

FBI warns of malware targeting corporate bank accounts - 11.4.2009
A new report from the FBI cyber crime division said hackers have attempted theft of $100 million from online bank accounts, using sophisticated malware that steals bank account passwords.

Microsoft issues Internet Explorer security update - 11.3.2009
Microsoft on Monday issued a security bulletin that updates a previous patch for Internet Explorer to resolve two issues. The IE bug only affects users who already applied the earlier patch.
View Related Resources
Or
Watch an Online Demo
Or
Have us call you now