Alarm raised over Adobe PDF zero-day vulnerability

Filed Under: Adobe, Malware, PDF, Vulnerability

Adobe Acrobat PDF folderIf you are one of the world's many users of Adobe's Acrobat PDF Reader software then there's good reason to prick up your ears and listen today, as details emerge of a critical zero-day vulnerability in the software that could allow hackers to run malicious code on computers.

According to a warning from the security response team at Adobe, a serious vulnerability in all currently supported versions of Adobe Reader and Acrobat ((Adobe Reader and Acrobat 9.1, 8.1.4, and 7.1.1 and earlier versions) are affected by the flaw.

The vulnerability, which is not limited to Windows users but also affects Mac and Unix users, means that Adobe users are being advised to disable JavaScript in Adobe Reader and Acrobat until a proper fix is available.

Adobe advises that JavaScript can be disabled by following these instructions:

1. Launch Acrobat or Adobe Reader.
2. Select Edit/Preferences
3. Select the JavaScript Category
4. Uncheck the "╦ťEnable Acrobat JavaScript' option
5. Click OK

Of course, this is far from the first time that critical vulnerabilities have been found in Adobe's software, and there is growing concern that the vendor's dominant market share of the PDF reader market is proving extremely attractive for hackers hellbent on infecting as many PCs as possible.

As we predicted in the Sophos 2009 Security Threat Report, hackers are increasingly looking at commonly used browser plugins like Adobe Flash and PDF in their attempts to infect innocent computer users.

In the past I've suggested that computer users may want to use FoxIt, an alternative to Adobe PDF Reader. However, on reflection, I think that advice wasn't that great because if everyone switched en masse to the same alternative to Adobe Reader we'd all be in the same pickle again.

A world of everyone using the same software as everyone else is never healthy for security.

Instead, make your own choice of which PDF reader to use. You can find a helpful list of some suggestions at http://pdfreaders.org/

,

You might like

About the author

Graham Cluley runs his own award-winning computer security blog, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Send Graham an email, subscribe to his updates on Facebook, follow him on Twitter and App.net, and circle him on Google Plus for regular updates.