There have been some massive hacks recently due to Flash -

- Hackers Exploiting Latest Adobe Flash Bug On Large Scale
- Adobe Patches Latest Flash Zero Day Vulnerability
- Adobe Promises Patch For Flash 0-day Being Used In Targeted Attacks

Those 3 were all in 2011!

Adobe has released a beta version of Flash Player for Firefox, which has better protection against vulnerability exploits because of a new sandboxed architecture.

“The design of this sandbox is similar to what Adobe delivered with Adobe Reader X Protected Mode and follows the same Practical Windows Sandboxing approach,” said Peleus Uhley, platform security strategist at Adobe, in a blog post on Monday. “Like the Adobe Reader X sandbox, Flash Player will establish a low integrity, highly restricted process that must communicate through a broker to limit its privileged activities.”

In secure software development, sandboxing refers to the practice of isolating a process from the operating system in order to minimize the fallout of a potential exploit. This type of technology has gained popularity in recent years, primarily because of its use in Google Chrome, a browser that has never experienced a successful remote code execution attack so far.

Adobe decided to implement sandboxing in Adobe Reader back in 2010 in order to counter the large number of exploits that targeted the product and its users. The technology was built into Adobe Reader X (10.0) and is based on the same sandboxing principles that Google used when developing Chrome.

Later that same year Adobe also launched a sandboxed version of Flash Player for Chrome and promised to explore the possibility of doing the same for other browsers. The new sandboxed Flash Player for Firefox, which works with Windows Vista and Windows 7, is the result of those efforts.

They have been talking about sandboxing for a long time and did mention they wanted to sandbox Adobe PDF Reader too, Chrome has had great success with it’s sandbox model and I’m sure many more software vendors will follow suit.

It’s good to see this approach with the web becoming an extremely dangerous place and more and more commerce is moving online, this gives us a deadly mix of poor security and lots of money floating around.

Critical Flash Player vulnerabilities have regularly been exploited to infect computers with malware during the past several years. Along with Java and Adobe Reader, Flash Player is one of the most attacked software applications, because its vulnerabilities can usually be exploited by simply visiting a malicious website.

“Since its launch in November 2010, we have not seen a single successful exploit in the wild against Adobe Reader X,” Uhley said. “We hope to see similar results with the Flash Player sandbox for Firefox once the final version is released later this year.”

However, the success of this version at deterring cybercriminals from writing Flash Player exploits in the future will largely depend on how quickly it gets adopted. In order to speed up the process, Adobe is working on a new update mechanism, the company’s senior manager for corporate communications, Wiebke Lips, said.

Having a sandboxed version of Flash Player for every major browser, not just Chrome and Firefox, is also important, if Adobe wants cybercriminals to lose interest in its product. “We are currently in the process of researching the best path to provide Flash Player sandbox protection for Internet Explorer,” Lips said.

However, because Internet Explorer has a completely different plug-in architecture than Chrome and Firefox, namely ActiveX, developing a sandboxed Flash Player version for it requires a different approach, Lips said. Nevertheless, the current version of Flash Player supports Protected Mode in Internet Explorer 7 or later on Windows Vista and Windows 7.

I’d like to see them implement a much better and more user-friendly update system for Flash player, so when the update comes out more users get it ASAP.

Also, this is only for Firefox and the largest target for malware peddlers is Internet Exploder Explorer – so they better get that version sorted out soon too.

Source: Network World

They’ve had to patch 4 times in the past 2 months – that’s a total of 6 times in 2011 so far – with 5 out of those 6 being for critical bugs.

It seems like Flash has become a major target for hackers in the past 6 months or so, despite the fact that Adobe has worked with Google to sandbox Flash in the Chrome browser.

Hackers are aggressively exploiting a just-patched Flash vulnerability, serving attack code “on a fairly large scale” from compromised sites as well as from their own malicious domains, a security researcher said Friday. The attacks exploit the critical Flash Player bug that Adobe patched June 14 with its second “out-of-band,” or emergency update, in nine days.

“CVE-2011-2110 is being exploited in the wild on a fairly large scale,” said Steven Adair, a researcher with the Shadowserver Foundation, a volunteer-run group that tracks vulnerabilities and botnets. “In particular this exploit is showing up as a drive-by in several legitimate websites, including those belonging to various NGOs [non-government organizations], aerospace companies, a Korean news site, an Indian government Web site, and a Taiwanese university.”

CVE-2011-2110 is the identifier for the Flash vulnerability assigned by the Common Vulnerabilities and Exposures database. Attackers are also using the exploit in “spear phishing” attacks aimed at specific individuals, said Adair on the Shadowserver site. Adair called the attacks “nasty” because the exploit “happens seamlessly in the background,” giving victims no clue that their systems have been compromised.

The CVE ID for this vulnerability is – CVE-2011-2110 with the NVD listing stating:

Adobe Flash Player before 10.3.181.26 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.23 and earlier on Android, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in June 2011.

Sounds pretty nasty, at least the patch is out for it – but as usual, how many people will apply it in a timely fashion?

When Adobe patched the vulnerability last week, it conceded that exploits were already in use.

Adair also said there’s been an increase in Flash-based attacks. “There has been an ongoing assault against Flash Player for several years now, but especially so in the last three months,” Adair said.

Adobe has patched Flash Player four times in the last two months, and six times so far this year. Of the six updates, five addressed “zero-day” bugs that attackers were already exploiting at the time the patches were issued.

Brad Arkin, Adobe’s director of product security and privacy, acknowledged the problems in keeping ahead of attackers, but blamed the popularity of Flash Player for the attention.

“The installed base [of Flash Player] is a real big part of it,” said Arkin. “It’s such a widely distributed technology that attackers find it worthwhile to invest the time to carry out some kind of malicious activity. They’re making an investment for the biggest return possible.”

Arkin also argued that attackers get more bang for their buck by rooting out Flash vulnerabilities than they do looking for bugs in individual browsers because virtually every personal computer has the Flash plug-in installed. “Flash is the code [used in the browser] that has the highest market penetration,” he said.

According to Adair, the exploit of CVE-2011-2110 has been in use since June 9, five days before Adobe issued its latest security update. Arkin corroborated that timeline.

Adobe does claim to be more pro-active about patching than Microsoft – which honestly isn’t really hard is it? Brad Arkin the head of security said:

“I think we’re more aggressive than Microsoft, basically, if we have information about attacks in the wild, or if the information is out there on a mailing list — which means attacks are imminent — that tends to be a trigger for us to think about an out-of-band.”

Do note they said ‘think’ about a patch though and not ‘issue’ one.

Source: Network World

They don’t have a great reputation for testing their software before releasing (the latest 10.2.x versions seem to be causing a LOT of problems on Firefox), so we’ll just have to hope it’s a good patch. They promised the patch for another deadly 0-day back in March, roughly about a month ago.

At least it’s patched now and I truly hope that the latest version also stabilises Flash Player for Firefox.

Adobe today patched a critical vulnerability in Flash Player that the company said criminals were already exploiting with malicious Microsoft Word and Excel documents. On Monday, Adobe acknowledged the bug , said exploits were circulating, and promised to fix the flaw with an emergency update.

Today’s update was Adobe’s second rush patch in less than four weeks. The new version, Flash Player 10.2.159.1, is available for Windows, Mac, Linux and Solaris. Missing from that list is Android, the Google mobile operating system that also runs Flash. A fix for the same flaw will be issued to Android users no later than the week of April 25, said Adobe.

Adobe will patch the popular PDF viewer Adobe Reader that same week. The Flash vulnerability also exists in Reader and the more advanced Acrobat because both include code that renders Flash content embedded in PDF files. Although initial attacks were launched using malicious Word attachments, hackers later expanded the campaign to include malformed Excel files, according to Mila Parkour, the independent security researcher who reported the Flash flaw to Adobe.

Parkour, who has been tracking the attacks for more than a week, has published information about them on her Contagio Malware Dump blog.

There’s no patch yet for the Android version of Flash, but Adobe has promised it will be pushed out by April 25th (next Monday). Incidentally they will also be patching PDF Viewer and Adobe Reader next week as they both render Flash and are also vulnerable to this exploit.

So Flash content embedded in PDF files is a viable vector for infection using this vulnerability, in the wild both Word and Excel files were being used (with embedded Flash files) to exploit the vulnerability.

Some of the earliest messages in the attack tried to get recipients to open the attached Word or Excel files by claiming they offered information on China’s antitrust laws, or a purported Japanese nuclear weapons program. Later messages were more mundane, and posed as corporate reorganization plans or new company contact lists.

Parkour also traced the resulting malware’s “phone-home” communications to a server registered in China, and noted that some of the malicious Word and Excel documents had been originally crafted in Chinese.

Google updated its Chrome browser — which includes a copy of Flash Player — Thursday, fixing not only the Adobe bug but a trio of critical vulnerabilities in the browser’s hardware acceleration technology. Like Internet Explorer and Firefox, Chrome taps the computer’s graphics processor (GPU) to handle some page composition and rendering tasks.

Google usually tags as “critical” only those bugs that attackers could use to escape the browser’s “sandbox,” an anti-exploit technology designed to prevent malicious code from escaping the browser.

Users running other browsers can download the patched version of Flash Player from Adobe’s site.

Google also updated Chrome recently with this Flash Player update and 3 other critical vulnerabilities related to the hardware acceleration in the browser.

I wonder how long it will be until the next critical 0-day vulnerability in Adobe Flash Player is exposed? Perhaps we’ll see another one in May.

And don’t forget to follow us on Twitter @THEdarknet to keep up with other interesting stories as they break.

Source: Network World

It wasn’t that long ago (back in October 2010) when there was another Critical 0-day Vulnerability In Adobe Flash Player, Reader & Acrobat and Adobe were scrambling to fix it.

They are promising an out of band patch for this vulnerability as it’s marked as critical and has apparently been seen in the wild, but only in a few targeted attacks according to this blog post by Adobe:

Background on APSA11-01 Patch Schedule

Adobe Systems plans to release emergency patches for its Flash and Reader applications after learning a critical vulnerability is being exploited to install malware on vulnerable machines.

The out-of-cycle patches for Adobe Flash Player 10 and Acrobat and Reader versions 9, 10, and X will arrive during the week March 21, the company said on Monday. The updates will cover all versions of those programs except for Reader X for Windows, which ships with a security sandbox that blocks the exploits Adobe has observed so far.

The announcement comes after members of Adobe’s security team received reports of targeted attacks aimed “at a very small number of organizations and limited in scope” that “install persistent malware on the victim’s machine,” the company said in an advisory. The exploits wield a booby-trapped Flash file hidden inside a Microsoft Excel file attached to an email.

The attacks exploit an unspecified flaw in Flash Player for the Windows, Mac, Linux, Solaris and Android operating systems. Adobe security members are unaware of other types of attacks, such as those that plant the malicious Flash file in documents using the the PDF, or portable document format, specification.

It’s a pretty tricky attack with multiple layers, it seems like the Flash exploit itself is embedded in an Excel file attached to e-mails. It looks like corporate users of Reader X will be out of luck as there is no patch for that version. But then Adobe states as Reader X comes with a sandbox the exploit won’t actually function anyway.

The patch is slated to come out next week sometime, there are no specifics as of yet – I guess it depends how long it takes them to fix the problem reliably. They are looking to rush the patch out though rather than waiting for the next cycle.

“However, attackers have leveraged these type [sic] of Flash Player vulnerabilities in the past via .pdf files to attack the embedded authplay.dll component shipping with Adobe Reader and Acrobat v9,” Brad Arkin, Adobe’s senior director of product security and privacy, wrote. “Out of a preponderance of caution we took the decision to ship out-of-cycle updates for Adobe Reader and Acrobat v9, and Acrobat X to mitigate the risk of attackers shifting the attack from an .xls container to a .pdf container.”

The unscheduled patch won’t cover Reader X for Windows, because that recently released version of the program contains a Sandbox that isolates remotely supplied payloads from the OS’s core functions. As a result, the exploits Adobe has seen to date aren’t able to successfully execute on machines that run it. Many Reader users, particularly those in corporate settings, still run versions 10 or 9 of Reader, meaning they will remain vulnerable until the emergency patch is installed.

Excluding Reader X for Windows from the out-of-cycle release will allow Adobe engineers to publish it more quickly than it otherwise could. The fix for that version will be released on June 14, during Adobe’s next scheduled quarterly update.

The Security Bulletin from Adobe is here:

Security Advisory for Adobe Flash Player, Adobe Reader and Acrobat

It has been assigned the CVE Number: CVE-2011-0609

Source: The Register

It was that long ago that a critical flaw in Flash put Android phones at risk. The core vulnerability exists in Flash but it’s being actively exploited in Adobe Reader via the usual pdf route.

The vulnerability exists across all OS versions (including Android), but as usual the active exploitation seems to be taking place on the Windows platform.

Adobe has confirmed reports that yet another unpatched vulnerability in the latest versions of its ubiquitous software is being actively exploited to infect end users with data-stealing malware.

The vulnerability exists in Adobe’s Reader document viewer and Flash Media Player for Windows, OS X and Unix operating systems, Adobe warned on Thursday. According to independent researchers, it is being exploited in the wild against Reader for Windows to install a nasty trojan known as Wisp, which according to Microsoft, steals sensitive user data and installs a backdoor on compromised systems.

The vulnerability itself resides in Adobe’s Flash Player, which is available as stand alone software and is also embedded into Reader. According to researcher Mila Parkour of the Contagio Malware Dump blog, poisoned PDF documents are circulating that drop two malicious binaries onto Windows machines that open the document files.

A screenshot identified the two files as nsunday.exe and nsunday.dll. A Virus Total scan showed just 15 of 42 antivirus programs were detecting the malicious EXE. She didn’t say whether the attacks succeed against more recent versions of the OS, which Microsoft has designed to withstand many of the most common types of exploits.

This vector comes to pass as Flash player is also embedded into Adobe Reader, so by using a malicious PDF file with the AuthPlay exploit – they can trigger the Flash player flaw and drop malware into the OS.

There is information on how to disable the AuthPlay functionality at the bottom of the Adobe advisory:

Security Advisory for Adobe Flash Player, Adobe Reader and Acrobat

Basically you need to go to the Adobe Reader directory and delete the AuthPlayLib.bundle (Windows/Mac OSX) or libauthplay.so.0.0.0. (linux) file.

Adobe said it planned to patch the vulnerability in Flash during the week of November 9 and in Reader during the week of November 15. The schedule is puzzling, since Reader has been confirmed to be under attack and Flash has not been confirmed.

In the meantime, users can protect themselves by using an alternate document viewer, such as Foxit. For those who must use Reader, Adobe said they can mitigate attacks by removing functionality known as AuthPlay, by following the instructions near the bottom of this advisory. Adobe provided no temporary measures Flash users can follow.

It’s been a bad couple of years for Adobe’s security team, which has gotten repeatedly hammered by critical vulnerabilities that are exploited by criminals to install malware on users’ machines. Three weeks ago, the company issued a fix for a security flaw in Reader that was also under attack by a highly sophisticated exploit. Last month, Adobe fixed a critical vulnerability in Flash that was also being used to compromise end user computers.

Adobe is also in the process of developing a patch for a code-execution bug in its Shockwave Player. By many researchers’ reckoning, Reader is among the world’s most exploited applications, in close competition with Oracle’s Java framework and, of course, various Microsoft programs.

From recent attacks it seems Adobe Reader and Flash are amongst the most exploited applications, especially when it comes to serious vulnerabilities that allow code-execution.

The new generation Adobe Reader with Sandbox Feature can’t come soon enough.

There’s also more here:

Hackers exploit newest Flash zero-day bug

Source: The Register

It’s good to see Adobe is taking this matter seriously and rather than just issuing patch after patch (firefighting) they are trying to do something fundamentally different with their PDF reader software to fix the root cause.

Now I’m not saying this will solve all the PDF related problems, but it’s good to see them doing a ground up rebuild and implementing safety features like sandboxing.

Adobe has offered more details of the ‘sandbox’ security feature it plans to implement to secure its hugely popular but often-attacked PDF Reader software. First announced last July, the latest description put out by Adobe’s security development team makes clear that Reader’s new ‘protected mode’ will be no mere bolt-on. This is starting to look like a ground-up re-design of how the program operates, almost from scratch.

The new Reader design will see core and risky PDF functions such as font rendering, Javascript execution, 3D rendering and image parsing happen within the confines of the application itself, isolating these from the privileges of the operating system.

This effectively relegates Reader to a new rung of privilege below that if the system user, which stops the application simply accessing key parts of the OS such as the Registry or file system as it likes. Instead all such calls will have to go through a trusted broker process if they want to communicate beyond the sandbox.

It’s a good model though and similar to what Google have done with the Chrome browser.

Separating the ‘dangerous’ parts from the parts that have access to the underlying OS is extremely important, JavaScript execution of course being the main culprit. But other exploits have focused on font and image rendering so they need to be kept away too.

The new design won’t stop exploits targeting Reader but they will limit what can be done from within its confines. At the moment, that is more or less anything the attacker wants, including being able to take over the system.

“The challenge is to enable sandboxing while keeping user workflows functional without turning off features users depend on,” says Adobe’s blog.

As the developers admit, the potential hole in security is always the operating system itself, which can still be compromised, although exploiting such vulnerabilities is as easy as it easy a few years back. Microsoft’s software development lifecycle (SDL) has tightened up code security. The first version sandbox will also not protect against read access to the file system (which allows data theft) or registry, or restricting network access, but future versions will look at this aspect of security.

Adding defence mechanism to specific applications other than browsers is an unusual approach to application design, but Reader’s security troubles have gone beyond that of most applications.

They have a pretty tough challenge on their hands as we know the more security you implement the less usability you have. So they have a precarious balance between retaining features which users require and limiting the amount of damage the software can do to the OS.

But it’s certainly a step in the right direction and as stated above, it certainly wont prevent there being any more exploits in Adobe’s PDF Reader – but it will limit the damage any future exploits can cause.

Source: Network World

This is a pretty serious flaw and sadly proves Steve Jobs right for not supporting Flash on the iPhone and Ipad. A new twist is that this vulnerability extends to mobile platforms such as Android due to the full support for flash. It also effects desktop systems across the board (Windows, Mac, Linux & Solaris).

Adobe revealed a critical zero day flaw in Adobe Flash–the second in less than a week. The vulnerability extends even to Adobe Flash on the Android mobile OS, supporting at least one of the reasons laid out by Steve Jobs for not allowing Flash on the iPhone and iPad.

An Adobe spokesperson contacted me and shared that, “A critical vulnerability exists in Adobe Flash Player 10.1.82.76 and earlier versions for Windows, Macintosh, Linux, Solaris and Android operating systems. This vulnerability also affects Adobe Reader 9.3.4 for Windows, Macintosh and UNIX, and Adobe Acrobat 9.3.4 and earlier versions for Windows and Macintosh.”

In a nutshell, the critical flaw could be exploited to crash the affected system, or may even allow an attacker to gain access and control it to execute additional malicious software. There are reports that this vulnerability is being actively exploited in the wild against Adobe Flash Player, but Adobe is not aware of any attacks exploiting it against Adobe Reader or Acrobat thus far.

The Adobe spokesperson explained, “Adobe is actively sharing information about this vulnerability (and vulnerabilities in general) with partners in the security community to enable them to quickly develop detection and quarantine methods to protect users until a patch is available. As always, Adobe recommends that users follow security best practices by keeping their anti-malware software and definitions up to date.”

There are reports of this vulnerability being exploited in the wild, but I haven’t really seen any details of it so far. It’s an interesting point regarding smart-phones and I wonder how Android developers might look at addressing this kind of issue and safeguarding the phones in the future.

A sandbox method might be a good idea, and from what I know of Android you don’t have root privileges by default anyway. We’ll have to see if Android makes any announcements regarding this or comes out with any kind of plan for future safeguards.

Those best practices are long established among the traditional desktop computing platforms, but users running Adobe Flash on Android smartphones may be left wondering exactly which “best practices” will protect them. Smartphones have grown into palm-based portable computers–with processing power and storage space significant enough to be a worthy target–but smartphone security is not as evolved as its desktop and notebook counterparts.

As Microsoft has improved its software development processes and implemented new security controls in the Windows operating system and other applications, attackers have looked elsewhere to find the chinks in the armor. Adobe has emerged as the virtually ubiquitous low-hanging fruit–with security practices that are not as mature as Microsoft’s, and software with potentially exploitable weaknesses available on pretty much every platform out there.

The iPhone and iPad stand uniquely apart from other smartphone and tablet platforms thanks to Apple’s very public rejection of Adobe Flash for iOS. While the real reasons probably have more to do with iAd and wanting to exert tighter control over the developer community, security is also a concern that has been cited. Zero day flaws like this one, which potentially impact Android smartphones running Adobe Flash, seem to illustrate the wisdom of that choice.

You can read the security advisory from Adobe here – Security Advisory for Flash Player, the fix has not been issued as yet but they do state they are working on it so expect a flash update soon.

It’ll be interesting to see what comes of this and how fast Adobe can push a patch out.

Source: Network World

Fairly wide-spread attacks based on the latest vulnerability in Adobe PDF Reader have been spotted by Symantec, they appear to be variants on old attacks but still can be very effective.

It’s not the first time this has happened, back in February 2009 Hackers targeted a 0-day exploit in PDF Reader.

With one variant of this current attack seeing 34,000 detections on Symantec’s network alone, it could be considered fairly widespread.

A week before Adobe is scheduled to patch a critical vulnerability in its popular PDF software, hackers are actively exploiting the bug with both targeted and large-scale attacks, a security researcher said today.

The SANS Institute’s Internet Storm Center (ISC) reported Monday that they’d received samples of a new rigged PDF document that hijacked PCs using a bug Adobe acknowledged Dec. 14 . Later last month, Adobe said it would not patch the bug until Jan. 12. In his write-up of the sample, ISC analyst Bojan Zdrnja called the attack PDF “sophisticated” and its use of egg-hunt shellcode “sneaky.”

“Egg-hunt shellcode” is a term for a multi-stage payload used when the hacker can’t determine where in a process’ address space the code will end up.

Today, Joshua Talbot, security intelligence manager at Symantec, confirmed that the malicious PDF exploited the Adobe Reader and Acrobat vulnerability, but unlike Zdrnja, said it wasn’t out of the ordinary. “It’s not particularly novel or sophisticated,” Talbot said.

It seems the solution is the same as it has always been, disable JavaScript support in PDF Reader. But honestly, how many non-tech savvy users will do that? Or even know HOW to do that?

Mine recommendation of course is always to use Foxit PDF Reader and avoid these issues all together.

Which I have of course recommended since 2008 back when Adobe PDF Reader was getting pwned 2 years ago.

All the maker of the recently-discovered exploit did, Talbot added, was take code published in a 2004 research paper and make minor modifications. “These techniques aren’t new or clever, but the same things that all attackers are doing,” Talbot argued.

Although the malicious PDF described by ISC has been seen in only limited numbers — designed for high-profile targets, such as company executives or personnel with access to network passwords — Symantec has monitored bigger attacks exploiting the PDF bug. One attack generated more than 34,000 detections on Symantec’s global detection network, peaking on Dec. 31 before falling sharply.

“We’re definitely seeing activity out there, since the vulnerability is unpatched,” said Talbot. When asked to put that attack on the size scale, Talbot answered, “That puts it in the class of being actively exploited. It shows that there’s both going on … that attackers are crafting one-off exploits for their own purposes, and that there are people who are trying to distribute exploits to as many people as possible.”

Hopefully Adobe will pull the patch forward seen as though this is being actively exploited and push the patch out to users ASAP.

It’s currently stated that Adobe will release the patch on January 12th at their support site, which thankfully isn’t too far off.

Perhaps they take testing seriously so their patch cycle will naturally be delayed.

Source: Network World

Another flaw in the Adobe product suite! It seems like PDF is turning into a complex animal, complexity of course always brings more security issues.

It was only back in February last year when there was a bug in Adobe Reader, and almost exactly a year later another one.

This time it’s a zero-day just hit and it is being actively exploited, with the worrying statement made that the fix will come in the ‘following weeks‘.

Hackers are targeting a zero-day vulnerability affecting Adobe Reader and Acrobat with malicious PDF files. Adobe officials say a fix for the issue will be available for Adobe Reader and Adobe Acrobat in the coming weeks.

Hackers have once again turned to PDF files to spread their wares, this time assaulting a zero-day flaw affecting Adobe Reader and Acrobat.

Fortunately, the unpatched bug is on the company’s radar, and fixes for Adobe Reader 9 and Acrobat 9 are slated to be available March 11. Updates for earlier versions will come later, company officials said in an advisory.

The bug is due to an error in the parsing of certain structures in PDF files. If exploited successfully, the bug could allow a hacker to take complete control of a vulnerable system.

Ok March 11th, only about 3 weeks to get a fix for a potentially very serious problem. Allowing complete control over the system, with the majority of people still using the Administrator account to user their computers on a day-to-day basis – that’s not good.

I don’t see how patch management will help here either, the patch won’t be out until 3 weeks after the exploit has become public. With attacks being targeted initially, and becoming more wide spread I would have thought immediate patching would have been more suitable.

“In parsing a specially-crafted embedded object, a bug in the reader allowed the attacker to overwrite memory at an arbitrary location,” blogged McAfee researcher Geok Meng Ong. “The attacks, found in the field, use the infamous heap spray method via JavaScript to achieve control of code execution.”

“While the distribution of this exploit thus far appears to be targeted, new variants are expected as more information is made public,” the researcher continued. “As with the Conficker experience, the lack of good patch management is a very worrying trend that deserves more attention from IT security practitioners. Adobe is expected to release a patch very soon.”

In the meantime, security researchers at the Shadowserver Foundation recommend users consider disabling JavaScript. Symantec also recommended Adobe users keep their antivirus up-to-date.

“While we continue to investigate this issue, customers are advised to follow best practices and only open email attachments from people they trust,” blogged Symantec researcher Patrick Fitzgerald. “Enabling DEP (Data Execution Prevention) for Adobe Reader will also help prevent this type of attack.”

There are some measures to can take to combat the problem, if you’re using Adobe on a corporate network you might want to think about pushing out some changes via Group Policy.

And well once again, another reason to use Foxit! PDF Reader.

Source: eWeek

It seems like some recently patched flaws in Adobe Reader are actively being exploited in the wild, mostly via malicious banners from various sites.

Nothing particularly nasty is happening, but a trojan is being installed which can intercept search engine results. It’s definitely recommended to update to the latest version (8.1.2).

Personally I don’t have such a problem…as I use Foxit Reader instead, I find Adobe software incredibly bloated.

iDefense says that on Friday it saw the same banner ad tactic being used in the wild to install a Trojan horse program. That Trojan, dubbed “Zonebac,” disables various anti-virus products and modifies the victim’s search engine results. As of late Friday evening, the company claims that not a single commercial anti-virus product detects this thing as malicious.

While having some unwelcome program monkey with your search results may not sound like the worst thing to have happen to your PC, cyber criminals may find more nefarious purposes for this vulnerability.

It’s an interesting target for criminals because Adobe Reader has a truly enormous install base, yet it is one of those applications that so few people even think to update regularly. According to Adobe, more than 500 million copies of Adobe Reader have been distributed worldwide on 23 platforms and in 26 languages. The product also is distributed by the top 10 PC manufacturers.

That’s a lot of installs of Adobe Reader, I would hazard a guess that only 10-20% max are regularly updated to the latest version – that leaves an aweful lot of people vulnerable to some pwnage by these spammers.

You can work out the rest of the figures yourself..

Adobe released an updated security advisory for this patch late Thursday, but it didn’t contain many more details than the original advisory, other than to credit iDefense and several other security vendors for reporting vulnerabilities. iDefense said an internal researcher discovered the flaw, and that the company alerted Adobe back on Oct. 11, 2007. A spokesperson for Fortinet, also credited in the latest advisory, said researchers alerted Adobe to their findings on Nov. 1, 2007.

Steve Gottwals, senior product management for Adobe Reader, declined to say how many vulnerabilities this 8.1.2 patch fixed, but confirmed reports that the attackers were already exploiting the flaw.

At least Adobe aren’t too slow with updates, I wish their software wasn’t so hugely bloated, come one it’s a PDF reader how freaking huge does it have to be?

It just displays PDFs!

Well it has to be 22.4mb for the latest Windows version, compare that with Foxit Reader which is 2.2mb – much faster and does exactly the same things.

I know which I prefer.

Source: Security Fix