Adobe Reader exploit spotted in the wild

Share this article:

Adobe is investigating reports that its Reader software contains a gaping hole that is under active exploit by attackers.

Researchers at security firm FireEye's Malware Intelligence Lab said Tuesday that the unpatched vulnerability impacts the latest versions of Reader: 9.5.3, 10.1.5 and 11.0.1. Once malware takes advantage of the flaw, its payload "drops" two dynamic-link libraries, or DLLs, which are application extensions used by executable files to perform a task. In this case, they allow the infected computer to communicate with a hacker-owned server.

"The first DLL shows a fake error message and opens a decoy PDF document, which is usually common in targeted attacks," FireEye said. "The second DLL in turn drops the callback component, which talks to a remote domain."

If the exploit is confirmed, that means it's able to work around beefed-up security protections in Reader, specifically a sandbox capability introduced with Adobe Reader X. The feature is designed to mitigate attacks against Reader by forcing operations that display PDF files to the user to be run inside a confined environment.

David Lenoe, who heads up Adobe's Product Security Incident Response Team, said in a post Tuesday that Adobe currently is evaluating the possible vulnerability.

The disclosure came on the same day as Adobe shipped regularly scheduled patches for vulnerabilities in its Flash and Shockwave players.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

CryptoWall surpasses CryptoLocker in infection rates

CryptoWall surpasses CryptoLocker in infection rates

A threat analysis from Dell SecureWorks CTU says that CryptoWall has picked up where its famous sibling left off.

Professor says Google search, not hacking, yielded medical info

Professor says Google search, not hacking, yielded medical ...

A professor of ethical hacking at City College San Francisco came forward to clarify that he did not demonstrate hacking a medical center's server in a class.

Syrian Malware Team makes use of enhanced BlackWorm RAT

Syrian Malware Team makes use of enhanced BlackWorm ...

FireEye analyzed the hacking group's use of the malware, dubbed the "Dark Edition" of BlackWorm.