Virtualization software maker VMware issued a bulky patch release today to shore up 18 vulnerabilities, most of which affect the critical ESX Server.
The 13 “highly critical” flaws affecting ESX Server versions 2 and 3, VMware‘s hypervisor-based virtualization solution, could be remotely exploited to cause a DoS attack or system compromise, according to a Secunia advisory.
Another five, less severe bugs impact related software, including the VMware Workstation, Server ACE and Player products, according to a separate Secunia advisory. The flaws, drawing a “moderately critical” rating, can be used in privilege escalation and DoS attacks.
Meanwhile, the same researcher who discovered the QuickTime-Firefox flaw that was patched this week, today disclosed a “high-risk vulnerability” affecting Adobe Acrobat and Reader.
“All it takes is to open a PDF document or stumble across a page which embeds one,” Petko D. Petkov said on his Gnucitizen website. “The issue is quite critical given the fact that PDF documents are in the core of today’s modern business.”
He said the vulnerability was identified on Windows XP using the latest Adobe Reader version. Petkov added that he does not plan to publish proof-of-concept code – as he did in the case of the QuickTime flaw – because Adobe produces closed-source software.
Paul Henry, vice president of technology evangelism at Secure Computing, told SCMagazine.com today that malware-laced PDFs could cause widespread harm.
“I see PDFs as tremendously socially acceptable documents to be included in emails and to be posted on websites to be downloaded by users,” he said. “We’re in a Web 2.0 world. Previously we were only concerned about traffic destined for our web server. Now, you have to be concerned about email reaching your users.”
He advised businesses to discourage employees from opening PDFs from unknown sources or from senders they were not expecting something from. Also, end-users should be wary of PDF files on the internet.
“It does no harm to be careful,” Henry said.
An Adobe spokesman said late Thursday that the company is aware of the vulnerability and has been working with Petkov to research the issue. If deemed necessary, a fix will be issued.