Description: Jelmer has discovered a vulnerability in Adobe Acrobat and Adobe Reader, which can be exploited by malicious people to disclose sensitive information.
The problem is that embedded Macromedia flash files are executed in a local context. This can be exploited to read local files by embedding a specially crafted flash file in a PDF file located on e.g. a malicious web site.
The vulnerability has been confirmed on Adobe Reader 6.0.1 and 6.0.2 for Windows.
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, using the Network Software Inspector.
Solution: Update to version 6.0.3.
Provided and/or discovered by: Jelmer
Changelog: 2004-12-15: Updated "Solution" section. Added link to vendor advisory.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
