Adobe Acrobat security vulnerability under attack

[David Baxter PhD]

Adobe Warns: Unpatched PDF Vulnerability Under Attack
By Ryan Naraine
October 9, 2009

Adobe has confirmed a critical, unpatched vulnerability in its PDF Reader/Acrobat software is being exploited by malicious attackers.

The vulnerability affects Adobe Reader and Acrobat 9.1.3 and earlier versions on Windows, Macintosh and UNIX. Adobe described the in-the wild attacks as limited and targeted, suggesting PDF documents rigged with exploits are being attached to e-mails and sent to business targets.

The exploit only targets Adobe Reader and Acrobat 9.1.3 on Windows.

Adobe's advisory offers some mitigations:

Adobe Reader and Acrobat 9.1.3 customers with DEP enabled on Windows Vista will be protected from this exploit. Disabling JavaScript also mitigates against this specific exploit, although a variant that does not rely on JavaScript could be possible. In the meantime, Adobe is also in contact with anti-virus and Security vendors regarding the issue and recommends users keep their anti-virus definitions up to date.​

Adobe plans to ship a patch for this flaw next Tuesday, October 13, 2009.

 

[Retired]

Adobe plans to ship a patch for this flaw next Tuesday, October 13, 2009.

This update is now available. Adobe Acrobat must be open for automatic update to detect the update. Otherwise, to manually apply the update, open Acrobat | Help | Check for Updates