Security beefed up in new Adobe Reader, Acrobat

Share this article:

Adobe this week released new versions of its flagship Reader and Acrobat products to include a number of new security capabilities.

Reader XI extends previously introduced sandbox "Protected View" controls -- in which PDFs are displayed in a confined environment to prevent malware from running elsewhere on the machine -- to now include "read-only" activities so hackers are unable to steal data via attacks, including so-called screen scrapes.

The new Reader and Acrobat editions also include a built-in security feature known as Address Space Layout Randomization, or ASLR. Introduced with the release of Windows Vista in early 2007, ASLR randomizes memory space and significantly lowers the chances for certain code execution attacks to succeed.

"Force ASLR improves the effectiveness of existing ASLR implementations by ensuring that all DLLs (dynamic-link libraries) loaded by Adobe Reader or Acrobat XI, including legacy DLLs without ASLR enabled, are randomized," Priyank Choudhury, a researcher with the Adobe Secure Software Engineering Team (ASSET), wrote in a Wednesday blog post. "By enabling Force ASLR in Adobe Reader and Acrobat XI, we are making it even more difficult for an attacker to exploit vulnerabilities."

The update also includes a new PDF Whitelisting Framework, which administrators can use to approve certain JavaScript running on PDF files or websites. In addition, the new versions offer support for elliptic curve cryptography (ECC) for digital signatures. ECC technology is generally considered a highly efficient form of public-key encryption.

Share this article:

Sign up to our newsletters

More in News

Brazilian president signs internet 'Bill of Rights' into law

Brazilian president signs internet 'Bill of Rights' into ...

President Dilma Rousseff signed the legislation on Wednesday at the NetMundial conference in Sao Paulo.

Android trojan sends premium SMS messages, targets U.S. users for first time

Android trojan sends premium SMS messages, targets U.S. ...

An SMS trojan for Android, known as FakeInst, has been observed sending premium SMS messages to users all over the world, including, for the first time, the United States.

Report: DDoS up in Q4 2013, vulnerability scanners leveraged to exploit sites

Report: DDoS up in Q4 2013, vulnerability scanners ...

Researchers observed 346 DDoS attacks in the final quarter of 2013 and attackers used Vega and Skipfish vulnerability scanners to exploit web flaws at financial companies.