Researchers expect widespread exploit of Adobe PDF flaw

Share this article:
Attackers are actively exploiting a gaping zero-day hole in versions 9 and earlier of Adobe Acrobat and Reader, the company has warned.

Adobe said Thursday that successful exploitation of the buffer overflow flaw could cause the application to crash and permit and attacker to take control of an affected system. The company said it plans to issue a patch by March 11 for version 9, and updates for versions 7 and 8 are scheduled to arrive soon after.

Researcher Steven Adair of the Shadowserver Foundation, a volunteer internet watchdog, recently tested a sample of the malicious PDF and determined that it relies on JavaScript for execution, according to a blog post he wrote Thursday.

Businesses can avoid infection by disabling JavaScript in Acrobat and Reader products, he said. Regardless, the exploit is likely to spread quickly.

"Right now, we believe these files are only being used in a smaller set of targeted attacks," Adair wrote. "However, these types of attacks are frequently the most damaging and it is only a matter of time before this exploit ends up in every exploit pack on the internet."

Shadowserver founder and director André De Mino told SCMagazineUS.com on Friday that users often are easily tricked into opening PDF files.

"People usually trust them," he said. "So certainly with JavaScript enabled in Acrobat, you can accomplish a lot of exploits."

Adobe said it is working with the major anti-virus providers so they can provide updated signatures for their customers.
Share this article:

Sign up to our newsletters

More in News

Incapsula mitigates multi-vector DDoS attack lasting longer than a month

Incapsula mitigates multi-vector DDoS attack lasting longer than ...

Incapsula's scrubbing servers were able to filter out more than 50 petabits of malicious DDoS traffic aimed at a video game company for longer than a month.

UPS announces breach impacting 51 U.S. locations

The shipping and printing provider said malware has been present on some stores' computer systems since mid-January.

'Machete' espionage campaign targets orgs in Venezuela, Ecuador

The campaign targets Spanish speaking victims, which also appears to be the native language of attackers.