Patch/Configuration Management, Vulnerability Management

Adobe urges upgrade to avoid critical bug

Adobe on Tuesday warned users of a critical flaw in Download Manager that can be exploited to compromise a user's machine.

The same day, the company released an updated version of Reader to address multiple flaws reported last week.

The "highly critical" bug, in versions 2.1 and earlier, is caused by the handling of section names when the application processes AOM files, according to Secunia. Attackers can exploit the flaw to cause a stack-based buffer overflow that could lead to the execution of arbitrary code, the vulnerability tracking firm said in an advisory.

In order for the attack to succeed, however, users must load a malicious Adobe file when visiting a website or through email, according to a company security bulletin released Tuesday.

In lieu of a fix, Adobe suggests users upgrade to Download Manager 2.2, which is not affected by the vulnerability. Download Manager is used to improve the downloading process of Adobe files.

In another bulletin released Tuesday, Adobe advised users to upgrade to Reader 8 to protect against bugs caused by memory corruption errors in the AcroPDF ActiveX Control. Hackers could exploit the vulnerabilities to take control of an affected system.

Click here to email Dan Kaplan.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.