Adobe investigating DoS "issue" in Reader
Story updated on Nov. 5 at 4:25 p.m. EST.
Adobe is investigating a "potential issue" in Reader that could permit the launch of denial-of-service attacks against affected computers, the company said Thursday.
The vulnerability, complete with proof-of-concept code, was first revealed on the Full Disclosure mailing list. The proof exploit did not demonstrate remote code execution, but it may possible, David Lenoe said Thursday in an Adobe Product Security Incident Response Team blog post.
Security firm VUPEN has, in fact, confirmed that the flaw can be remotely exploited to execute malicious code, according to an advisory Friday.
While Adobe investigates, users of Reader 9.2 or later versions or 8.1.7 and later versions are encouraged to use the JavaScript Blacklist Framework, a mechanism to block vulnerable JavaScript APIs that eliminates the need to block all of JavaScript. The blog post details specific instructions.
Adobe, which stopped short of calling the latest issue a vulnerability, did not say when it might have more information.
It is expected to update Reader and Acrobat sometime during the week of Nov. 15 for a zero-day vulnerability that is being actively exploited.
