Monday, May 17, 2021

Adobe Issues Emergency Patch for Reader, Acrobat

One week after news broke of a zero-day vulnerability in its Reader PDF software, Adobe has issued an out-of-band patch to address the problem. Security experts advise users to install the update as soon as possible.

The Next Web’s Emil Protalinski reported, “Adobe on Wednesday released a security bulletin addressing a vulnerability in its Reader and Acrobat products discovered and being exploited exactly a week ago. The vulnerability in question could cause a crash of either and software and potentially allow an attacker to take control of the affected system.”

Brian Prince from eWeek noted, “The patch follows a warning from security firm FireEye last week that attackers were launching malicious PDFs at Windows users in a zero-day attack. According to FireEye, when the vulnerability was successfully exploited, it would deploy two Dynamic Link Library (DLL) files. The first would show a fake error message and open a decoy PDF document. The second file deployed a callback component that talked to a remote Internet domain. The attackers were able to bypass the Adobe Reader sandbox, FireEye’s senior director of security researcher, Zheng Bu, told eWEEK last week.”

Dark Reading’s Kelly Jackson Higgins observed, “The exploit used the two bugs to bypass Adobe Reader 10’s sandbox feature and to sneak past the Protected Mode sandbox in Reader XI — key security features Adobe had added to its apps to prevent malware from poisoned PDFs from spreading to other parts of the machine.”

Security Watch’s Max Eddy added, “The patch is recommended by Adobe for all users of Adobe Reader and Acrobat, XI and earlier. The update impacts Windows, Macintosh, and Linux users for versions 11.0.01, 10.1.5, 9.x, and earlier versions of Adobe’s software. The patch can be downloaded from Adobe’s website, or through the company’s automatic update feature.”

Similar articles

Latest Articles

What is Data Annotation?

You've completed a hefty round of raw data collection, and now you want to feed that information into artificial intelligence (AI) machines, so they...

How IBM has Changed...

Think is IBM’s big annual conference, and again this year, it was digital. I’m noticing a sharp quality difference in shows like this where...

Database-Tuning Platform Launches and...

PITTSBURGH — A team out of Carnegie Mellon University is launching its automatic database-tuning product today with the help of $2.5 million in funding.   OtterTune,...

Top 10 Professional Services...

Professional services automation (PSA) software aims to offer service-based companies most of the software they will need to run their businesses in one package....