Adobe promises quarterly security updates. Quarterly??!!?

[David Baxter PhD]

Adobe Reader and Acrobat Security Initiative
by Brad Arkin, Director of Product Security and Privacy, Adobe
May 20, 2009

The recent JBIG2 vulnerability (CVE-2009-0658), the associated exploits, and Adobe?s response (APSB09-04) were the subject of much discussion in the security community in February and March. The JBIG2 issue also sparked a lot of conversation internally at Adobe from executives to testers and developers. What started out as a routine incident response expanded to a broader effort by Adobe Reader and Acrobat engineers, culminating in permanent changes to our software security approach for those products.

Since February, Adobe Reader and Acrobat engineers have been executing a major project focused on software security. Everything from our security team?s communications during an incident to our security update process to the code itself has been carefully reviewed. Security is an ongoing process, so while we believe our plan will eliminate or mitigate many potential security risks, we are also working to enhance our ability to respond to externally found vulnerabilities in Adobe Reader and Acrobat in the future.

In particular, we have focused this security effort in three major areas:

1. Code Hardening - For the past several years all new code and features for Adobe Reader and Acrobat have been subject to our modern Secure Product Lifecycle (SPLC). The Adobe SPLC is similar to Microsoft?s Security Development Lifecycle (SDL). The Adobe SPLC integrates standard secure software activities such as threat modeling, automated and manual security code reviews, and fuzzing into the standard Adobe Product Lifecycle we follow for all projects.
   
   The SPLC activities have been successful in mitigating threats in new code development, but did not fully address problems in the existing code base. Therefore, an initiative in the current security effort has been focused on hardening at-risk areas of the legacy code. We?ve applied the latest SPLC techniques against these prioritized sections of each application. Even in cases where no immediate vulnerability was identified, we have been strengthening input validation on a best-practice basis. (Experience shows such validation is a powerful tool in preventing as-yet unidentified security holes.)
   
2. Incident Response Process Improvements ? We?ve targeted several specific areas where we are improving our incident response process. We expect folks outside Adobe will see more timely communications regarding incidents, quicker turn-around times on patch releases, and simultaneous patches for more affected versions as we move forward.
   
   This approach was tested sooner than we would have liked with CVE-2009-1492/1493. Although this incident fell in the middle of our security effort, we were encouraged by the progress our response demonstrated. We worked to communicate early and often via our PSIRT blog and two weeks later, on May 12, 2009, we simultaneously shipped 29 binaries to update 17 different versions of Adobe Reader and Acrobat covering 32 languages for the Windows, Mac, and UNIX platforms.
   
3. Regular Security Updates ? Starting this summer with the initial output of our security code hardening effort, we plan to release security updates for all major supported versions and platforms of Adobe Reader and Acrobat on a quarterly basis. Based on feedback from our customers, who have processes and resources geared toward Microsoft?s ?Patch Tuesday? security updates, we will make Adobe?s quarterly patches available on the same days. (Although our 3/10/09 and 5/12/09 security patches landed on Patch Tuesday, the timing was coincidental. In both cases, we shipped the patches as soon as we finished testing them.)

Software security is a rapidly evolving field and we are always on the lookout for ways to best adapt to the changing threat landscape. In developing this new approach to product security for Adobe Reader and Acrobat we?ve leveraged lessons learned by our friends and partners in the community. We look forward to continuing the conversation in person at some upcoming security conferences.

 

[David Baxter PhD]

The amazing thing to me about this announcement is that the author seems proud of it.

Seriously - quarterly updates to security vulnerabilities that can take down someone's computer? That's nothing to boast about. That's not even an adequate response.

But what it does succeed in doing is delivering the message loud and clear that nobody, absolutely nobody, should be counting on Adobe products for security.

Ditch Adobe Acrobat Reader now and replace it with Foxit Reader!