Adobe offers mitigation for Reader 0-day attack, fix is yet to come
Posted on 14 February 2013.
Bookmark and Share
Adobe has confirmed FireEye researchers' findings about new Adobe Reader and Acrobat zero-day vulnerabilities being exploited in the wild and has issued a security bulletin detailing the flaws and offering mitigation advice until a patch is released.

The vulnerabilities (CVE-2013-0640, CVE-2013-0641) are present in Adobe Reader and Acrobat 11.0.01, 10.1.5, 9.5.3 and all their earlier versions for Windows and Macintosh, and allow attackers to compromise the systems of users who have been tricked into opening a malicious PDF file delivered via email.

The date for the release of the fix has not yet been determined. Until its release, users of Adobe Reader and Acrobat 11 are advised to enable the Protected View option (File > Edit > Preferences > Security (Enhanced) > choose the "Files from potentially unsafe locations" or "All files" options). Enterprise administrators can do the same for all Windows users across their organization by enabling Protected View in the registry and propagating that setting via GPO or any other method.

Users of all the other versions might consider using another PDF viewer for the time being, or updating to Adobe Reader and Acrobat 11 and go through the previously mentioned steps.

When enabled, the Protected View option makes all PDF documents open in a sandbox, and the question now is why it is not enabled by default.

FireEye researchers have released more details about their analysis of the found malicious PDF and say that it contains highly obfuscated JavaScript that can check which version of Reader and Acrobat the user is using and creates customized attack code for each of the versions found.

The code is also able to bypass the ASLR and DEP protection, and employs anti-analysis tricks that may allow it to "muddy up" sandbox analysis reports.









Spotlight

Dissecting the unpredictable DDoS landscape

Posted on 23 April 2014.  |  DDoS attacks are now more unpredictable and damaging than ever, crippling websites, shutting down operations, and costing millions of dollars in downtime, customer support and brand damage, according to Neustar.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Wed, Apr 23rd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //