New Zero-Day Adobe Attack Under Way

Adobe Reader and Acrobat are under siege once again, this time via targeted attacks exploiting a previously unknown flaw in the software that lets an attacker crash the app and wrest control of the victim's machine. Adobe plans to issue an out-of-band update by next week for Windows-based systems only.

"The reason for addressing this issue quickly for Adobe Reader and Acrobat 9.4.6 for Windows is simple: This is the version and platform currently being targeted. All real-world attack activity, both in this instance and historically, is limited to Adobe Reader on Windows. We have not received any reports to date of malicious PDFs being used to exploit Adobe Reader or Acrobat for Macintosh or UNIX for this CVE (or any other CVE)," said Brad Arkin, senior director of product security and privacy for Adobe said in a blog post today.

Arkin says users of Adobe Reader or Acrobat 9 and earlier versions should immediately upgrade to Adobe Reader or AcrobatX, which are safe from the exploit and attack due to the Protected Mode and Protected View features. Adobe will fix the issue in Adobe Reader and Acrobat X for Windows in the company's next scheduled security update on Jan. 10.

"The risk to Macintosh and UNIX users is significantly lower. We are therefore planning to address this issue in Adobe Reader and Acrobat X and earlier versions for Macintosh as part of the next quarterly update on January 10, 2012. An update to address this issue in Adobe Reader 9.x for UNIX is planned for January 10, 2012," Arkin said.

Arkin says that, thus far, no malware has been able to penetrate Adobe Reader or Acrobat X.

Meanwhile, the new zero-day is just another dangerous flaw in a series for Adobe Reader and Acrobat, says Paul Henry, security and forensic analyst for Lumension Security. "As recent as 2009, Adobe earned the title of “most hacked software of the year” when malicious PDF files accounted for more than 80% of all exploits for the year. Be on guard this holiday season – PDF files have long been a popular vehicle to transport obfuscated malware in Spear Phishing Attacks and this vulnerability makes that task even easier," Henry said in a blog post today.

"In light of the never ending stream of issues with Adobe Reader and Acrobat, users may want to consider achieving a little “security by obscurity” with any one of more than a dozen Adobe alternates for PC and Mobile platforms" including Sumatra PDF; Foxit Reader, Nitro Reader, Chrome PDF Viewer Plug-In and others, he said.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.