Adobe promises Reader, Acrobat patches for Tuesday
Thursday, May 7, 2009
Adobe last week promised to patch the zero-day vulnerability in its Adobe Reader and Acrobat software no later than Tuesday, acknowledging the security bugs in a post on the Adobe product security response blog.
On Friday, Adobe's security team said it would issue updates to Adobe Reader and Acrobat versions 7, 8 and 9 for Windows and versions 8 and 9 for Mac and Linux.
"We are in the process of fixing the issue," which said David Lenoe, the company's security program manager, in a blog post. "Additionally, we have confirmed the second vulnerability (CVE-2009-1493) for Adobe Reader for Unix."
"This issue will be resolved in the upcoming Adobe Reader for Unix updates," the post said. "Currently, we have not been able to reproduce an exploitable scenario for Windows and Macintosh, but we will continue to investigate."
The Adobe Reader and Acrobat problem involves possible exploits of JavaScript which allow remote attackers to cause a denial of service or execute arbitrary code via a PDF file.
Proof-of-concept exploit code for both flaws has been circulating the web, according to eWeek. Adobe said it is not aware of any attacks, the website reported.
Users are advised to disable JavaScript in Reader and Acrobat until the patch available.

|