Secunia CSI7
About us
Careers
Memberships
Newsroom
Contact us
Blog
News
Articles

Adobe Reader/Acrobat 0-day Clarification

Get this blog as an RSS Feed
By now, most people should hopefully be aware of the 0-day vulnerability currently being actively exploited in Adobe Reader/Acrobat.
16:05 CET on the 24th February 2009
Entry written by Carsten Eiram.

By now, most people should hopefully be aware of the 0-day vulnerability currently being actively exploited in Adobe Reader/Acrobat.

We initially heard rumours about this 0-day vulnerability on 16th February 2009 and began digging for something more concrete over the following days. Three days later, Adobe confirmed the existence of the 0-day vulnerability and Secunia issued an advisory. Later, a more in-depth analysis was provided to customers on our Secunia Binary Analysis Service.

Disabling JavaScript does not prevent exploitation
Over the last couple of days, we have seen many sources recommend users to disable support for JavaScript in Adobe Reader/Acrobat to prevent exploitation. While this does prevent many of the currently seen exploits from successfully executing arbitrary code (as they rely on JavaScript), it does not protect against the actual vulnerability.

During our analysis, Secunia managed to create a reliable, fully working exploit (available for Secunia Binary Analysis customers), which does not use JavaScript and can therefore successfully compromise users, who may think they are safe because JavaScript support has been disabled.

All users of Adobe Reader/Acrobat should therefore show extreme caution when deciding which PDF files to open regardless of whether they have disabled JavaScript support or not. Hopefully, Adobe will be issuing patches very soon.

Stay Secure,

Carsten Eiram,
Chief Security Specialist

 

Discuss this blog entry
A new thread in our forum is created. Activate the thread by commenting/discussing below.
Subject: Adobe Reader/Acrobat 0-day Clarification
 
No posts yet

-

You must be logged in to post a comment.



 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Factsheets
Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability