Adobe Reader Exploit in the Wild

[Glenn H]

Buffer overflow issue in versions 9.0 and earlier of Adobe Reader and Acrobat

Release date: February 19, 2009
Vulnerability identifier: APSA09-01
CVE number: CVE-2009-0658
Platform: All platforms

Summary

A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited.

Adobe is planning to release updates to Adobe Reader and Acrobat to resolve the relevant security issue. Adobe expects to make available an update for Adobe Reader 9 and Acrobat 9 by March 11th, 2009. Updates for Adobe Reader 8 and Acrobat 8 will follow soon after, with Adobe Reader 7 and Acrobat 7 updates to follow. In the meantime, Adobe is in contact with anti-virus vendors, including McAfee and Symantec, on this issue in order to ensure the security of our mutual customers. A security bulletin will be published on http://www.adobe.com/support/security as soon as product updates are available.

All documented security vulnerabilities and their solutions are distributed through the Adobe security notification service. You can sign up for the service at the following URL: http://www.adobe.com/cfusion/entitlement/index.cfm?e=szalert

Affected software versions

Adobe Reader 9 and earlier versions
Adobe Acrobat Standard, Pro, and Pro Extended 9 and earlier versions

Severity rating

Adobe categorizes this as a critical issue and recommends that users update their virus definitions and exercise caution when opening files from untrusted sources.


How it works: http://vrt-sourcefire.blogspot.com/2009/02/have-nice-weekend-pdf-love.html

How it could attack Macs: http://www.tuaw.com/2009/02/20/acrobat-vulnerability-may-affect-mac-users/

[JHickman]

Thanks for posting this!

[Glenn H]

Secunia has released a PoC exploit that works the same way WITHOUT Javascript. So just turning javascript off isn't the whole solution.

http://secunia.com/blog/44/

Also Adobe has updated their Flash player and plugins to stop an exploit that has been around for about a month.

Man Adobe really is fighting a losing battle and not telling people well in advance about it

[Glenn H]

Now you don't even need to open the PDF for your machine to be exploited

http://www.readwriteweb.com/archives/a_new_twist_to_the_adobe_vulnerability.php

[woljed]

I switched to Foxit Reader once I heard about this.

[Glenn H]

I switched to Foxit Reader once I heard about this.

As all people should anyway. Foxit is so small and not such a memory grubbing hog of a program that Adobe Reader is.

[Glenn H]

Foxit also vulnerable but the fix is already released for it

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9129264

[Len Snark]

Thanks for the tip--I didn't know that Foxit even existed.

[Glenn H]

Adobe Acrobat Reader 9.1 update(1 day ahead of schedule to fix exploits)
http://get.adobe.com/reader/

Adobe Acrobat Standard and Pro 9.1 update (1 day ahead of schedule to fix exploits)
http://www.adobe.com/support/downloads/detail.jsp?ftpID=4375