Critical Adobe Reader Flaw Virtually Ignored

If a tree falls in the woods and there's no one there to hear it, does it still make a sound? Such is the conundrum faced by philosophers for generations.

What if a critical flaw in Adobe Reader was demonstrated before a group of security professionals at the Black Hat conference and none of them made a sound, either?

That's what Charlie Miller must be thinking. He's the security expert that presented the vulnerability at Black Hat. His lament?

"Adobe security is so bad that […] not a single person tweeted it. Sad."

Adobe has acknowledged the flaw and is said to be working on a fix. Whether the patch is released out of band or at Adobe's next scheduled quarterly security release remains to be seen. Also unclear is the list of versions impacted by the vulnerability. The only good news is that there are no reports of exploits in the wild.

Some question how many more security blows Adobe can endure before going down for the count. My response is to look at Microsoft's track record. Many years into their latest secure coding push, Redmond is scheduled to release 14 patches to close 34 vulnerabilities in their August 2010 Bulletin Release. This mandates a massive amount of testing and deployment for enterprise customers, yet Windows is still the dominant operating system and office suite. The cost of switching away is substantial due to user training, infrastructure, and application impacts that it's almost cheaper to stick with the ugliness you know.

The same holds true for Adobe. It's the PDF reader with the most saturation, and not just among corporate environments. Home users are virtually guaranteed to have Adobe Reader installed on their systems, even though fully functional alternatives exist. Many have found Reader installed as a bundled offering from another application. The home user is also more likely to have an unpatched operating system and outdated software offerings, making exploit trivial. Antivirus protection? Please.

Adobe's install base and numerous versions places the company in the same predicament as Microsoft. There's a lot of old, insecure stuff out there, and even offering an automatic update solution only partially solves the problem. If Adobe can get 80% of the vulnerable installs patched, that still leaves hundreds of thousands, perhaps millions, of ripe targets out there. And when the next critical Adobe flaw appears - and you know it's when, and not if - the hamster wheel spins again.

My advice is the same as always. Dump Adobe products for less target-rich alternatives. A simple Google search on PDF readers will return scores of options onto your screen. Be sure to completely uninstall any Adobe software currently on your machine, being wary of third-party apps that might have plunked down some version while you whistled through a boring install routine. If in doubt, use Task Manager to look for processes associated with Adobe products.

Otherwise, abandon hope all ye who enter Adobeville. Like another Scream sequel, this will not end well.

Adobe Flash Player Update Fixes 32 Security Flaws

It should tell you something that Adobe's latest Flash Player update, released in response to ongoing exploits of a particular vulnerability, actually plugs 32 holes in the buggy software.

The Metasploit Framework has code that targets the critical flaw previously reported, so don't mess around in getting this update installed. You'll need to run the update for each browser on your system, so if you use Internet Explorer and Firefox, remember to update both.

You can test which version of Flash Player is currently installed by visiting this site with each of your browsers. You can then download and install the correct version at the Flash Player Download page.

If you'd like more information about Adobe's security struggles, check out the following posts:

Critical Adobe Flaw Being Exploited In The Wild - Again

Adobe Reader and Internet Explorer: Most Attacked

The Adobe Attacks Keep On Coming

Adobe To Fix Flash Flaws This Week

Another Day, Another Adobe Zero-Day Exploit

Critical Adobe Flaw Being Exploited in the Wild - Again

Adobe systems is reporting that a critical vulnerability affecting Adobe Acrobat, Reader, and Flash is actively being exploited in the wild.

The previously unknown flaw could crash a user's system or result in the attacker taking full control of the affected machine.

Adobe's current advice is for users to delete, rename, or remove access to the “authplay.dll” file included in both Reader and Acrobat while Adobe works on an official patch. This may not be fully effective, given that other programs may also drop this key .dll file during installation.

From the Adobe Product Security Incident Response Team blog:

A Security Advisory has been posted in regards to a new Adobe Reader, Acrobat and Flash Player issue (CVE-2010-1297). A critical vulnerability exists in Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems, and the authplay.dll component that ships with Adobe Reader and Acrobat 9.x for Windows, Macintosh and UNIX operating systems. This vulnerability could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild against both Adobe Flash Player, and Adobe Reader and Acrobat.

I've written often about Adobe's struggle with securing their product sets, and this is yet another instance where consumers are left to essentially fend for themselves.

Given the Advanced Persistent Threat environment which has developed, third-party peripheral applications continue to be seen by attackers as low-hanging fruit as they seek attack vectors to compromise consumer and corporate hosts. Adobe products are often targeted because of the ease with which they can exploited, combined with a heavy deployment saturation and poor updating practices by home users and enterprise IT departments, to the point where Adobe recently implemented code to install updates and versions automatically.

I've said it before, and I'm saying it again. Get off of Adobe products if at all possible. You can limit your attack surface by 2/3 if you simply move to an alternate .pdf file creater/reader application, and there are many free programs out there.

For now, try to implement the mitigation Adobe recommends if you can't uninstall the products, and wait for a patch.

The Adobe Attacks Keep on Coming

Hackers are actively exploiting a previously unreported vulnerability in both Adobe Acrobat and Reader to compromise vulnerable computers worldwide.

And the Adobe hits keep on coming.

The flaw, in versions 9.2 and earlier, has been assigned CVE-2009-4324. Adobe's advisory provides very little information about the weakness being exploited in the wild, and no suggestions for mitigating exposure while we await a patch.

Initial reports point to turning off Javascript within the Adobe product itself as one method of protection, which might work for now, but as more exploits are crafted and launched, the delivery and execution mechanisms might change.

An alternative is to move away from Adobe products, as I noted here, here, here, here, and here.

Adobe continues to struggle with the security architecture of their products, and moving to a quarterly patch release hasn't given them the infosec street cred they were hoping to achieve. If you're still using Adobe to process .pdf files, then you're walking around with your pants around your ankles half the time as the bad guys have their way with you. Meanwhile, Adobe works on yet another patch for their leaky ship.

Bite the bullet and start using alternative .pdf products. Most of them are even free, so there's no good excuse for sticking with a vendor who keeps doing you wrong.

Adobe Security Bulletin Fixes 28 Flaws

Wow, that's a big security advisory. Adobe's quarterly patch release includes 28 fixes for Adobe Reader and Acrobat of various versions.

Several critical vulnerabilities are addressed, so make sure you don't dally on this one. Here's a list of the CVEs as reported by Adobe:

CVE number: CVE-2007-0048, CVE-2007-0045, CVE-2009-2564, CVE-2009-2979, CVE-2009-2980, CVE-2009-2981, CVE-2009-2982, CVE-2009-2983, CVE-2009-2984, CVE-2009-2985, CVE-2009-2986, CVE-2009-2987, CVE-2009-2988, CVE-2009-2989, CVE-2009-2990, CVE-2009-2991, CVE-2009-2992, CVE-2009-2993, CVE-2009-2994, CVE-2009-2995, CVE-2009-2996, CVE-2009-2997, CVE-2009-2998, CVE-2009-3431, CVE-2009-3458, CVE-2009-3459, CVE-2009-3460, CVE-2009-3461, CVE-2009-3462

By the way - why are you still using Adobe products?

Image by Midiman's photostream via flickr

The Critical Adobe Flaws Keep On Coming

Adobe is reporting limited, targeted attacks against a new critical vulnerability in both Reader and Acrobat.

The flaw impacts Reader and Acrobat 9.1.3 and earlier Windows, Mac, and UNIX, but the current attacks are only targeting Windows. Adobe plans on fixing the issue in their scheduled quarterly patch release on October 13, 2009.

Disabling JavaScript may not protect you from all variants of the attack. Adobe has yet to publicly disclose the actual vulnerability, obviously hoping to limit attacks until they roll out their quarterly release. Antivirus vendors have been notified, and hopefully they are distributing AV definitions that alert on the known variants.

Adobe to Fix Flash Flaw This Week

CNET Security is reporting that Adobe is planning to release fixes this week to close some of the critical flaws in their Flash player that are currently being exploited in the wild.

July 30 is the target date for Flash Player v9 and v10 on Windows, Mac, and Linux. No date for a Solaris fix has been set.

Reader and Acrobat v9.1.2 for Windows, Mac, and UNIX are scheduled for July 31, since both shared some common flawed code with Flash.

Keep in mind that there are still exploits in the wild, so either disable Flash, or use the NoScript add-on if you're a Firefox browser user.

Another Day, Another Adobe Zero-Day Exploit

It's really beginning to look like Adobe will never, ever get their act together when it comes to security.

The latest zero-day exploit originally looked like it only impacted PDF files, so naturally it was assumed that it was an Adobe Reader issue. Further forensics revealed that it was actually a Flash vulnerability, the code of which is shared between Adobe's Flash Player and Reader products.

This is bad news on a couple of levels, the primary one being that it increases the number of attack vectors to leverage PDF files embedded with malicious Flash, or the bad guys can simply try to exploit the Flash Player itself. Right now the exploit is dropping a trojan onto the victim's machine.

Having Javascript disabled in Reader doesn't even help, since it's Flash being exploited. Not only have malicious sites sprung up hosting the zero-day, but reports are coming in that drive-by attacks are also in progress, executed via injecting malicious links into otherwise legitimate web sites.

The flaw has been known since late in 2008, but it appears to have only recently been crafted for exploit via a heap spray technique. Since Flash is operating system independant and incorporated into nearly every web browser, there's really no safety net for anyone out there yet.

Adobe has limited information available on their Product Security Incident Response Team blog.

US-CERT is recommending the following workarounds:


• Disable Flash in Adobe Reader 9 on Windows platforms by renaming the following files: "%ProgramFiles%\Adobe\Reader 9.0\Reader\authplay.dll" and "%ProgramFiles%\Adobe\Reader 9.0\Reader\rt3d.dll".
• Disable Flash Player or selectively enable Flash content as described in the "Securing Your Web Browser" document.

Update 10:29 PM - Not a single antivirus product is triggering on the malicious .swf files

Image by GoGap via flickr

Adobe Re-patches Shockwave, So Should You

Software maker Adobe (motto: security is hard) has announced that they've released a fix for a critical flaw in their Shockwave multimedia player. This flaw could allow remote exploitation of a vulnerable computer.

Adobe claims that the flaw had been fixed in an earlier version of the product, and recommends uninstalling whatever Shockwave version is currently being used, rebooting the machine, then installing the latest version.

"This issue was previously resolved in Shockwave Player 11.0.0.465; the Shockwave Player 11.5.0.600 update resolves a backwards compatibility mode variation of the issue with Shockwave Player 10 content," the company stated.

Adobe is currently unaware of any exploits for this particular vulnerability.

Security Update Available for Shockwave Player

Adobe Patch Tuesday for June 09

Update June 9, 6:55 PM - Adobe has released their security bulletin - mercifully it's only one item, APSB09-07, that is associated with 13 CVEs for Adobe Reader and Acrobat. The bad news is that the bulletin calls out that the fixes for the UNIX platform won't be out for another ten days, which gives the bad guys a good amount of time to reverse-engineer the vulnerabilities from the Windows and Mac code and create exploits for the UNIX world.

Original Post - Don't forget that June 9 will be Adobe's first foray into releasing patch bundles in a Microsoft-esqe manner, although Adobe plans to go the quarterly route rather than the monthly bulletins that come out of Redmond.

A number of the patches will be rated as Critical by Adobe, which typically means that malicious code can be executed without user interaction, so you'll want to stay tuned and fix those ASAP.

Experts are anticipating fixes for Acrobat Reader and Adobe Acrobat, for both Windows and Mac platforms. Details are still to come for fixes for those products on the UNIX operating system.

If you're not already using some other PDF viewer, you should be. You'll be surprised at how much faster it will load and render compared to Adobe Reader, and it's not nearly the attack vector, either.

Adobe Drops Patch Tuesday Hammer on Us

Adobe products have been the proverbial deer in the security headlights the last couple of years, with the firm standing accused of everything from shoddy application development to long turn-around times on their fixes when problems are discovered.

Some of the same charges were historically leveled at Microsoft, who responded with a hailstorm of security patches each time they had a fix to roll out.

Beleaguered system administrators and corporations wailed about how difficult it was to keep up with the pace, since one hotfix had barely been tested and deployed before another was in the chute.

Microsoft responded by designating the 2nd Tuesday of each month as "Microsoft Patch Tuesday", as it came to be known amongst the tech crowd. While it didn't necessarily stem the flood of fixes needing deployed, it did allow for better resource management and regular cycles for UAT testing prior to distributing the code into the production environment.

It seems Adobe has taken a lesson from Microsoft, in that they have announced that they will release security fixes on a quarterly basis, on the 2nd Tuesday of every third month.

Adobe, responding to criticism of poor security practices and a maddeningly slow response to known vulnerabilities, also promised to release emergency fixes on a more timely basis while doing a better job of continuously reviewing their products from a security engineering perspective, the hope being that they will identify (and close) vulnerabilities before they become widely known and exploited. This would be welcome news for security professionals, who have seen Adobe products targeted in almost half of the targeted attacks so far this year.

By emulating Microsoft's refined process already institutionalized in most companies, Adobe hopes to piggyback off of the painful lessons learned in Redmond. That strikes me as an admission that Adobe doesn't know how to execute core vulnerability management processes or develop them internally.

This approach is obviously meant to stop the bleeding as more infosec professionals are contemplating moving away from Adobe's platform to alternative products that have less of a target painted on them.

While I wish Adobe success in their endeavor, I'm not optimistic that they will be able to maintain the pace of the security patch treadmill over the long term.

Adobe Reader: Worse than a face punch?

Brian Krebs writes in his Security Fix blog that Adobe is warning of yet another serious flaw in the Acrobat Reader product. Gee, what were the odds?

Preliminary reports indicate that some sort of Javascript flaw exists, primarily on Reader for Linux platforms but probably on other OS flavors too.

Installing and using the Adobe Reader app is like punching yourself in the face over and over again. It hurts and just doesn't make sense, so stop it already.

There are tons of other PDF readers available, so move to one of them, regardless of whether you're on Windows, Linux, or a Mac, uninstall Acrobat Reader, and start the healing process.

Security Fix - Adobe Warns of Potential Reader Flaw

Adobe (finally) Issues Update

Adobe has finally released an update to mitigate a critical vulnerability that first became public knowledge back in January.

The security update is for Acrobat Reader 9 and Acrobat 9. You really shouldn't be on an older version at this point unless you have some peculiar application compatibility issues. Fixes for versions 7x and 8x of both products will reportedly be available by March 18, and an update for Reader 9.1 for Unix is expected on March 25.

If you use other PDF readers or writers, you may also need to apply an update for that particular software. Be sure to check the vendor website or run the update feature from the tools or help menu.

Adobe Flash Update

Time to update your Adobe Flash player installation again.

The latest updates fixes at least five vulnerabilities, several of them considered to be critical. You could become compromised by simply visiting a website that's hosting a malicious Flash movie.

Depending on which browser(s) you use, it might take a couple of visits to the Adobe site to update appropriately - make the visit in your Internet Explorer browser, then Firefox, Opera, etc. if you're not using a product like Secunia PSI.

Do it soon - the bad people are waiting to get you.

Information is the Best Defense

HD Moore has an excellent piece in the Metasploit blog about how full disclosure of software vulnerabilities can actually be defensible, regardless of the whining that results from software vendors.

In this particular case, Moore uses the recent Adobe Acrobat vulnerability as his case study. Depending on which online account you happen to read, it appears that rumors of this unpatched flaw were circulating as far back as December 2008, and it wasn't until the bright light of disclosure was brought to bear did Adobe finally get in gear to address the issue.

As Moore states so eloquently, If the vendor involved was Microsoft, the press would be tearing them apart right now. What part of "your customers are being exploited" do they not understand?