Adobe Reader's Patch Tuesday

Next Tuesday, Jan. 12, is Microsoft Patch Tuesday. Beyond the usual patches from Microsoft, we will also get a critical update for a piece of software that increasingly plays a role in exploiting desktop systems -- the Adobe Reader from Adobe Systems.In 2009, the flaws in the Adobe Reader program were the target of choice for many attackers. Adobe Reader is a program that allows reading, printing, and form-filling of PDF files, a very popular document file format. The Reader program is downloadable for free directly from Adobe and often comes preinstalled on PCs. It is cross-platform, working in similar ways on Windows, Mac OS X, and Linux/Unix. Flaws in the Reader program can also be cross-platform, making it a very attractive attack target, with an installed base larger than Windows itself.

In the past year, security researchers and exploit writers have found many security holes in the product, a number of which are included in commercial exploit kits that can be purchased online. These exploit kits allow anybody with basic technical knowledge to craft an attack file that can be sent by e-mail and planted on popular Websites for download. Often the files generated have a "serious" subject -- how to protect oneself from the swine flu, news about tax returns, etc. -- making them more successful because many users do not expect an attack from these type of files.

On several occasions, flaws were found in Adobe Reader by attackers rather than security researchers and became exploits before Adobe was able to issue a patch. There were three instances of these so-called zero-day vulnerabilities in 2009, with the latest on schedule to be fixed next week.

The frequency and severity of these flaws make it a top priority to decide on how to deal with PDF file format attacks in any organization's 2010 security to-do lists. But no matter what the final decision is, it is essential to update to the latest software version, use an alternative PDF reader that is less scrutinized by attackers, perhaps just uninstall the software, and create an inventory of existing installed version. All modern vulnerability management tools cover Adobe Reader vulnerabilities and provide that inventory mechanism. Typical system management solutions also offer a way to catalog installed software; a number of free programs also are available that can help a smaller organization's needs.

-- As the CTO for Qualys, Wolfgang Kandek is responsible for product direction and all operational aspects of the QualysGuard platform and its infrastructure. Wolfgang has more than 20 years of experience in developing and managing information systems. His focus has been on Unix-based server architectures and application delivery through the Internet. Wolfgang provides the latest commentary on his blog: laws.qualys.com and also publishes his Patch Tuesday commentary to the QualysGuard channel: www.youtube.com/QualysGuard. He is a frequent source in business and trade media and speaks at industry conferences around the world, most recently at RSA 2009.