Adobe Reader exploit spotted in the wild

Share this article:

Adobe is investigating reports that its Reader software contains a gaping hole that is under active exploit by attackers.

Researchers at security firm FireEye's Malware Intelligence Lab said Tuesday that the unpatched vulnerability impacts the latest versions of Reader: 9.5.3, 10.1.5 and 11.0.1. Once malware takes advantage of the flaw, its payload "drops" two dynamic-link libraries, or DLLs, which are application extensions used by executable files to perform a task. In this case, they allow the infected computer to communicate with a hacker-owned server.

"The first DLL shows a fake error message and opens a decoy PDF document, which is usually common in targeted attacks," FireEye said. "The second DLL in turn drops the callback component, which talks to a remote domain."

If the exploit is confirmed, that means it's able to work around beefed-up security protections in Reader, specifically a sandbox capability introduced with Adobe Reader X. The feature is designed to mitigate attacks against Reader by forcing operations that display PDF files to the user to be run inside a confined environment.

David Lenoe, who heads up Adobe's Product Security Incident Response Team, said in a post Tuesday that Adobe currently is evaluating the possible vulnerability.

The disclosure came on the same day as Adobe shipped regularly scheduled patches for vulnerabilities in its Flash and Shockwave players.
Share this article:

Sign up to our newsletters

More in News

Health care breaches continue to rise, over 30M affected

As breaches hitting the health care industry continue to ramp up, more than 30 million individuals have been affected by these incidents thus far.

'Backoff' malware compromises POS devices in New Orleans restaurant

Anyone that used a credit or debit card at Mizado Cocina between May 9 and July 18 may have had their data compromised.

FBI begins investigation into 1.2 billion stolen credentials

A couple weeks after Hold Security's initial discovery of the stolen logins, the Federal Bureau of Investigation is conducting its own review.