At least! Adobe has sorted itself out and released patches for 17 critical vulnerabilities in their Reader and Acrobat applications. We reported back in January about Active Exploitation Of Unpatched PDF Vulnerabilities.

The latest slew of vulnerabilities has been actively exploited by hackers for at least the past month as detected in the wild by anti-virus companies. Many of the vulnerabilities were critical and could lead to remote code execution, especially combined with the recent flash exploits.

They had to step up as well and get the patches out fast because the code went public in June.

Adobe on Tuesday patched 17 critical vulnerabilities in Reader and Acrobat, including one that hackers have been using for nearly a month to commandeer PCs.

Another patch fixed a design flaw in the PDF format that attackers have been exploiting since April to dupe users into downloading a Trojan horse.

Adobe rushed the security update, which was originally slated to ship July 13, because exploit code went public and attacks using rigged PDF documents started showing on antivirus vendors’ reporting systems four weeks ago. The company patched Flash — hackers were tricking people into visiting malicious sites, then using the same bug to launch drive-by attacks — on June 10.

Sixteen of the 17 fixed flaws were labeled with the phrase “could lead to code execution” in Adobe’s advisory , the company’s way of saying that the bug was critical and could be used to hijack machines. Like Apple , and unlike Microsoft , Adobe doesn’t rate the severity of the vulnerabilities it patches. The seventeenth patch was also likely critical: “Arbitrary code execution has not been demonstrated, but may be possible,” the advisory read.

Looks like they’ve been having some serious problems, not just run of the mill exploits but problems with the very architecture and design of the Adobe software. Some of the biggest malware vectors for distribution last year came from Adobe Reader flaws.

And it has been happening in the wild, these flaws allowed malicious bot-net herders to peddle their wares and infect thousands of people.

Another fix addressed a design problem in the PDF document format that could be leveraged to con users into downloading malware. The bug, which was not strictly a security vulnerability, was first disclosed by Belgium researcher Didier Stevens in late March. Stevens demonstrated how a multi-stage attack using the PDF specification’s “/Launch” function could successfully exploit a fully-patched copy of Adobe Reader. Stevens also showed how a Reader warning could be changed to further fool users.

Hackers have been using Stevens’ technique in mass attacks to infect Windows PCs with bot Trojans.

With the updates to versions 9.3.3 and 8.2.3, Adobe changed Reader and Acrobat so that the /Launch function was disabled by default — in earlier editions it had been turned on — and fixed the bug in the warning dialog so hackers couldn’t modify it. “Today’s update includes changes to resolve the misuse of this command,” said Steve Gottwals, an Adobe group product manager, on a company blog . “We added functionality to block any attempts to launch an executable or other harmful objects by default. We also altered the way the existing warning dialog works to thwart the known social engineering attacks.”

Stevens confirmed the fixes in a post to his blog Tuesday. “Not only is the dialog box fixed, but the /Launch action is also disabled by default,” he said.

Five of the 17 bugs Adobe patched Tuesday were reported by Tavis Ormandy, the Google security engineer who was at the center of a brouhaha earlier this month after he publicly disclosed a vulnerability in Windows when Microsoft wouldn’t commit to a patching deadline.

Thankfully they’ve disabled the /Launch function by default now and fixed other bugs which were classified as critical. Incidentally 5 of the 17 bugs were reported by Tavis Ormandy the Google engineer.

That guy has quite a record for uncovering software based vulnerabilities.

Source: Network World

Another flaw in the Adobe product suite! It seems like PDF is turning into a complex animal, complexity of course always brings more security issues.

It was only back in February last year when there was a bug in Adobe Reader, and almost exactly a year later another one.

This time it’s a zero-day just hit and it is being actively exploited, with the worrying statement made that the fix will come in the ‘following weeks‘.

Hackers are targeting a zero-day vulnerability affecting Adobe Reader and Acrobat with malicious PDF files. Adobe officials say a fix for the issue will be available for Adobe Reader and Adobe Acrobat in the coming weeks.

Hackers have once again turned to PDF files to spread their wares, this time assaulting a zero-day flaw affecting Adobe Reader and Acrobat.

Fortunately, the unpatched bug is on the company’s radar, and fixes for Adobe Reader 9 and Acrobat 9 are slated to be available March 11. Updates for earlier versions will come later, company officials said in an advisory.

The bug is due to an error in the parsing of certain structures in PDF files. If exploited successfully, the bug could allow a hacker to take complete control of a vulnerable system.

Ok March 11th, only about 3 weeks to get a fix for a potentially very serious problem. Allowing complete control over the system, with the majority of people still using the Administrator account to user their computers on a day-to-day basis – that’s not good.

I don’t see how patch management will help here either, the patch won’t be out until 3 weeks after the exploit has become public. With attacks being targeted initially, and becoming more wide spread I would have thought immediate patching would have been more suitable.

“In parsing a specially-crafted embedded object, a bug in the reader allowed the attacker to overwrite memory at an arbitrary location,” blogged McAfee researcher Geok Meng Ong. “The attacks, found in the field, use the infamous heap spray method via JavaScript to achieve control of code execution.”

“While the distribution of this exploit thus far appears to be targeted, new variants are expected as more information is made public,” the researcher continued. “As with the Conficker experience, the lack of good patch management is a very worrying trend that deserves more attention from IT security practitioners. Adobe is expected to release a patch very soon.”

In the meantime, security researchers at the Shadowserver Foundation recommend users consider disabling JavaScript. Symantec also recommended Adobe users keep their antivirus up-to-date.

“While we continue to investigate this issue, customers are advised to follow best practices and only open email attachments from people they trust,” blogged Symantec researcher Patrick Fitzgerald. “Enabling DEP (Data Execution Prevention) for Adobe Reader will also help prevent this type of attack.”

There are some measures to can take to combat the problem, if you’re using Adobe on a corporate network you might want to think about pushing out some changes via Group Policy.

And well once again, another reason to use Foxit! PDF Reader.

Source: eWeek