disclosed a vulnerability in its Reader and Acrobat products that can be exploited by remote attackers using malicious PDF documents.
The flaw, acknowledged Friday by Adobe, exists in Adobe Reader version 8.1 and earlier versions, Acrobat Standard, Professional and Elements 8.1 and earlier and Acrobat 3D on PCs running Windows XP
with Internet Explorer 7
installed, according to an advisory
from the San Jose, Calif.-based company.
The vulnerability is caused by an input validation error when processing a specially crafted “mailto” link, according to FrSIRT
Adobe said on Friday that the company's researchers are working on updated versions of the affected products to fix the issue.
FrSIRT and Adobe advised users to disable the mailto option in the Windows registry.
Meanwhile, researchers have reported that after an initial spike
, attackers are turning away
from PDF spam. Secunia
today updated a July advisory
on a flaw in the way Windows handles URI commands, including Adobe Reader and Acrobat as possible attack vector.
The Copenhagen-based vulnerability monitoring firm advised users to avoid untrtusted websites, links or PDF files.
spokesperson said today that the Redmond, Wash.-based company is aware of flaw reports and investigating the issue.