Adobe, Foxit PDF Vulnerabilities Show Danger of Remote Code Execution

It's not been a good week for PDFs and security.

In the span of seven days, Adobe and Foxit, a rival PDF provider, released dozens and dozens of security patches for their respective software. Several of these patches addressed vulnerabilities that could lead to an attack using remote code execution.

These types of vulnerabilities can allow attackers using remote code execution exploits to gain access to larger portions of an enterprise network -- an important concern for businesses, especially since PDF files and readers remain important to corporate work. By using code execution, an attacker could create a malicious PDF document that if opened, then would install malware on an endpoint device.

In addition, since many of these PDF tools (specifically Foxit) come with browser plugins, the person reading a document could trigger an attack by merely viewing the PDF file in the browser.

(Source: iStock)

Foxit, which is seen as a cheaper alternative to the more expensive Adobe software, sent out a security notification on September 28 that patched more than 100 different vulnerabilities in its Reader 9.3 and Foxit PhantomPDF 9.3. Many of those patches fixed remote code vulnerabilities.

This massive security patch update came a few days before Cisco Talos published a blog post on October 1 that highlighted 18 of the vulnerabilities Foxit fixed.

At about the same time, Adobe sent out an October update for its popular Acrobat and Reader products, designed to address over 80 different vulnerabilities. Many of these were deemed critical and tackled remote code execution vulnerabilities.

Once again, Talos, along with several other security vendors, highlighted some of the vulnerabilities following the release of the patch.

What these updates show is the importance of patching software, especially applications that are used within enterprises every day. Timur Kovalev, CTO of San Jose-based network security provider Untangle, notes in an email that it only takes one vulnerability to compromise an entire network.

The Foxit vulnerabilities were especially troubling, Kovalev noted.

"It is critical for any person or business using the Foxit products to immediately upgrade to the newest version to ensure the vulnerabilities are patched. Browser plugins have led to hackers exploiting weaknesses in the past, so it is important users understand the risk of enabling plugins," Kovalev wrote in an email to Security Now.

"Always check the credentials of the software publisher, and ensure that unnecessary plugins are uninstalled. Hackers are always looking for the weakness in a product, network or device, so ensuring your systems are up-to-date and businesses are proactively protecting their employees and networks from the latest threats are crucial steps to stay one step ahead," he added.

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.