Adobe products struck by zero-day attacks

Adobe holes
Adobe’s products are once again in the firing line, as hackers are reportedly exploiting critical unpatched vulnerabilities in the products Adobe Reader, Acrobat and Flash Player.

Adobe has published a security advisory describing the problems which affect users regardless of whether they’re running Windows, Mac OS X, Linux, Solaris or UNIX.

Adobe has labelled the zero-day vulnerabilities as “critical”, the most serious rating it has.

Adobe says that Adobe Reader and Acrobat version 8.x are not vulnerable, and that the Flash Player 10.1 release candidate “does not appear to be vulnerable”.

Although Adobe has published a way to mitigate the problem for Adobe Reader and Acrobat 9.x for Windows, the workaround is clearly not ideal:

Deleting, renaming, or removing access to the authplay.dll file that ships with Adobe Reader and Acrobat 9.x mitigates the threat for those products, but users will experience a non-exploitable crash or error message when opening a PDF file that contains SWF content.

Mind you, maybe I wouldn’t be so bothered about that in actual fact. After all, when would I ever want to open a PDF containing ShockWave Flash content inside it?

Once again, it sounds as if feature-itis (the technical term for a product suffering from excessive inflation of unnecessary features) could have partly been Adobe’s undoing in this example. A simple PDF reader without so many bells and whistles might not have suffered from such exploitation.

Brad Arkin, director of product security at Adobe, says that the firm is working on a patch – although it is not yet known when it will be available.

Meanwhile, the team at SophosLabs has described some mitigations which can help protect against the Adobe vulnerability on their blog.