Adobe products struck by zero-day attacks

Filed Under: Adobe, Adobe Flash, PDF, Vulnerability

Adobe holes
Adobe's products are once again in the firing line, as hackers are reportedly exploiting critical unpatched vulnerabilities in the products Adobe Reader, Acrobat and Flash Player.

Adobe has published a security advisory describing the problems which affect users regardless of whether they're running Windows, Mac OS X, Linux, Solaris or UNIX.

Adobe has labelled the zero-day vulnerabilities as "critical", the most serious rating it has.

Adobe says that Adobe Reader and Acrobat version 8.x are not vulnerable, and that the Flash Player 10.1 release candidate "does not appear to be vulnerable".

Although Adobe has published a way to mitigate the problem for Adobe Reader and Acrobat 9.x for Windows, the workaround is clearly not ideal:

Deleting, renaming, or removing access to the authplay.dll file that ships with Adobe Reader and Acrobat 9.x mitigates the threat for those products, but users will experience a non-exploitable crash or error message when opening a PDF file that contains SWF content.

Mind you, maybe I wouldn't be so bothered about that in actual fact. After all, when would I ever want to open a PDF containing ShockWave Flash content inside it?

Once again, it sounds as if feature-itis (the technical term for a product suffering from excessive inflation of unnecessary features) could have partly been Adobe's undoing in this example. A simple PDF reader without so many bells and whistles might not have suffered from such exploitation.

Brad Arkin, director of product security at Adobe, says that the firm is working on a patch - although it is not yet known when it will be available.

Meanwhile, the team at SophosLabs has described some mitigations which can help protect against the Adobe vulnerability on their blog.

, , , ,

You might like

About the author

Graham Cluley runs his own award-winning computer security blog at, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Follow him on Twitter at @gcluley