CDRInfo Forum CDRInfo Forum

Forums  Register  Login  My Profile  Inbox  Address Book  My Subscription  My Forums 

Photo Gallery  Member List  Search  Calendars  FAQ  Ticket List  Log Out

Adobe leaves security holes in PDF reader download.   Logged in as: Guest
Viewers: 1150 You can click here to see Today's Posts | Most Active Topics | Posts Since Last Visit
  Printable Version
All Forums >> [News Around The Web] >> Software News >> Adobe leaves security holes in PDF reader download. Page: [1]
Login
Message << Older Topic   Newer Topic >>
Adobe leaves security holes in PDF reader download. - 7/21/2009 10:08:35 AM   
astra

 

Posts: 462
Joined: 4/1/2009
Status: offline
Adobe has delivered an out-of-date version of Reader to users who download the popular application from its website, a security company warned today.

The edition Adobe currently offers includes at least 14 security vulnerabilities that have been patched by the company in the last two months.

Danish vulnerability tracking vendor Secunia first noticed that Adobe was offering an outdated Reader when users of its Personal Software Inspector (PSI) utility - which scans Windows PCs for unpatched applications - started complaining when the tool said they were running a vulnerable version, even though they had just downloaded the PDF viewer.

"There was some confusion about Adobe Reader," said Mikkel Winther, the manager of the PSI partner program. "Users had downloaded the latest Reader, but still PSI was telling them that it was vulnerable."

At first, Secunia suspected that PSI was throwing off a "false positive," but that wasn't the case. "Adobe.com ships software with known vulnerabilities," Winther said.

The version now hosted on Adobe's website, said Winther, is Reader 9.1, an edition that was released on 10 March to plug several holes, including one that had been actively exploited by hackers since at least 9 January 9, 2009.

Adobe has issued two security updates since then. The first, released 12 May, patched another "zero-day" bug in Reader, while the second, issued 9 June, fixed at least 13 critical flaws reported by outside researchers and secretly patched an unspecified number of bugs found by Adobe's own security team.

Computerworld confirmed that Adobe's website offers Reader 9.1 to users who download the application. Adobe did not reply to a request for comment on why it posts an out-of-date edition on its site.

"Adobe does have the Adobe Updater, which will eventually update Reader to the patched versions," said Winther, "but sometimes it takes days or weeks for the updater to come up." By default Adobe's updater pings the company server once a week.

Adobe's practice leaves users vulnerable to hackers who rely on malformed PDF documents to hijack PCs, said Winther. If a user receives a PDF - likely as an attachment to an email message - but doesn't have Reader installed, then downloads and installs Reader 9.1 from the company's site, he can be successfully attacked by exploits fixed in Version 9.1.1 and 9.1.2.

"PC users need to patch all their vulnerable programs and they need to do so as fast as possible after the patch has been issued from the vendor," said Winther. "Failing to do so is playing Russian Roulette.... It is only a question of time, and luck, when your system will be compromised."

Winther urged users who have recently downloaded and installed Reader to manually update the application by selecting "Check for Updates" from the "Help" menu. Alternately, they can download and run Secunia's PSI tool to locate any outdated software.


http://www.computerworlduk.com/
Post #: 1
Page:   [1]
All Forums >> [News Around The Web] >> Software News >> Adobe leaves security holes in PDF reader download. Page: [1]
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts




Forum Software © ASPPlayground.NET Advanced Edition 2.4.5 ANSI

0.047