Adobe to patch Acrobat and Reader next week

Summary:Both Reader and Acrobat for Windows and Mac are vulnerable to one or more critical vulnerabilities.

Adobe has released Preliminary Notification of security updates to Acrobat and Reader next Tuesday, December 9. Microsoft schedules updates for Acrobat and Reader regularly on Patch Tuesday every three months.

The vulnerable versions of Reader XI and Acrobat XI are 11.0.09 and earlier. The vulnerable versions of Reader X and Acrobat X are 10.1.12 and earlier.

Adobe says that the updates address critical "vulnerabilities" in the software, but we do not yet know how many there are and how many are critical.

The company gives the updates for all four products a priority rating of 1, which is the most severe and is used to indicate either that the vulnerability is being exploited in the wild or could be easily exploited with severe consequences. Given that these updates are being released on the regular schedule it is less likely that they are known to be used in the wild.

When the updates are released, the Preliminary Notification page will become the Security Bulletin page for the updates.

Larry Seltzer has long been a recognized expert in technology, with a focus on mobile technology and security in recent years. He was most recently Editorial Director of BYTE, Dark Reading and Network Computing at UBM Tech. Prior to that he spent over a decade consulting and writing on technology subjects, primarily in the area of sec... Full Bio

View the original article here

Time's up: Google releases attack code for serious Adobe Reader bug

Windows users who haven't updated to the latest version of Acrobat and Adobe Reader probably should do so right now, after a Google security researcher revealed details of a vulnerability affecting the pair, and how to exploit it.

As Adobe noted in its September security update for Acrobat and Reader on Windows, version 11.0.8 of the two programmes was vulnerable to a sandbox bypass that could allow an attacker to run native code with escalated privileges on Windows. US-CERT gave it a severity rating of 10.

The bug was discovered by James Forshaw, a security researcher in Google's Project Zero initiative. Forshaw has now released further details of the flaw, making it more important for Windows users to update to version 11.0.9 of Acrobat and Reader, since attackers can use the information to devise an attack for the vulnerability. Details released this week include a proof of concept exploit, source code, and pre-compiled binaries.

Project Zero is part of Google's effort to clean up widely-used third-party software with the aim of reducing the number of people potentially harmed by zero-day attacks. The program is separate to its own bug bounty program for researchers who report flaws in Google software.

Flaws discovered by the Project Zero team are housed in an external database and are kept under wraps until the vendor of the affected product issues a patch for it, or 90 days after it was reported to the vendor. In this case, Adobe has released a fix and the 90 days were up on November 26.

According to Forshaw, the sandbox escape in version 11.0.8 was possible due to a "race condition in the handling of the MoveFileEx call hook". 

"While the function resolves the location of the source and destination and ensures they are within the policy, there is a timing race once the function calls into the MoveFileEx function in the broker. This race can be won by the sandboxed process by using an OPLOCK to wait for the point where the MoveFileEx function opens the original file for the move. This allows code in the sandbox to write an arbitrary file to the file system," Forshaw wrote.

He noted that technically version 11.0.9 doesn't fix the race condition, however the update did make it "difficult if not impossible to exploit" due to additional defences Adobe made available in the update.

According to Forshaw, the update made it "no longer possible to use the broker file system hooks to create directory junctions".

View the original article here