Adobe on Thursday warned that a critical security vulnerability
exists in its Acrobat and Reader software.
"This vulnerability would cause the application to crash and could
potentially allow an attacker to take control of the affected
system," Adobe says in its security advisory. "There are
reports that this issue is being exploited."
Symantec security researcher Patrick Fitzgerald explains that
the vulnerability is caused by a PDF parsing error. "Once the
malicious document is opened it will trigger the vulnerability," he
said in a blog post. "The JavaScript payload then sprays the heap
with the malicious shellcode in an attempt to increase the chances
of a successful exploit. If the exploit is successful, a malicious
binary will be dropped and executed on the victim's system."
Fitzgerald says that the malicious payload is a backdoor Trojan
that comes from an open source toolkit known as Ghost that
originated in China. Once installed on a computer, it allows the
attacker to view the victim's desktop, record keystrokes, and
access the machine remotely.
The vulnerability affects Adobe Reader 9 and earlier versions,
and Adobe Acrobat Standard, Pro, Pro Extended 9, and earlier
versions.
Adobe plans to release updates for Acrobat Reader 9 and Acrobat
9 by March 11, with updates for earlier versions of the software to
follow.
In the meantime, Steven Adair, a security researcher with
Shadowserver Foundation, advises that users disable JavaScript on
their computers if they use either Adobe Reader or Adobe
Acrobat.
"[W]e found that disabling JavaScript would definitely prevent
the malware from being installed on the system," he explained in an
online post. "However, it would still result in the crash of the
application. We would HIGHLY recommend that you DISABLE JAVASCRIPT
in your Adobe Acrobat [Reader] products. You have the choice of
small loss in functionality and a crash versus your systems being
compromised and all your data being stolen. It should be an easy
choice."
In addition, US-CERT recommends preventing PDF documents from
being opened automatically in Internet Explorer, disabling the
display of PDF documents in any Web browser, and exercising caution
when one receives PDF files from an unknown source.