Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

1/7/2010
03:43 PM
Wolfgang Kandek
Wolfgang Kandek
Commentary

Adobe Reader's Patch Tuesday

Next Tuesday, Jan. 12, is Microsoft Patch Tuesday. Beyond the usual patches from Microsoft, we will also get a critical update for a piece of software that increasingly plays a role in exploiting desktop systems -- the Adobe Reader from Adobe Systems.



Next Tuesday, Jan. 12, is Microsoft Patch Tuesday. Beyond the usual patches from Microsoft, we will also get a critical update for a piece of software that increasingly plays a role in exploiting desktop systems -- the Adobe Reader from Adobe Systems.In 2009, the flaws in the Adobe Reader program were the target of choice for many attackers. Adobe Reader is a program that allows reading, printing, and form-filling of PDF files, a very popular document file format. The Reader program is downloadable for free directly from Adobe and often comes preinstalled on PCs. It is cross-platform, working in similar ways on Windows, Mac OS X, and Linux/Unix. Flaws in the Reader program can also be cross-platform, making it a very attractive attack target, with an installed base larger than Windows itself.

In the past year, security researchers and exploit writers have found many security holes in the product, a number of which are included in commercial exploit kits that can be purchased online. These exploit kits allow anybody with basic technical knowledge to craft an attack file that can be sent by e-mail and planted on popular Websites for download. Often the files generated have a "serious" subject -- how to protect oneself from the swine flu, news about tax returns, etc. -- making them more successful because many users do not expect an attack from these type of files.

On several occasions, flaws were found in Adobe Reader by attackers rather than security researchers and became exploits before Adobe was able to issue a patch. There were three instances of these so-called zero-day vulnerabilities in 2009, with the latest on schedule to be fixed next week.

The frequency and severity of these flaws make it a top priority to decide on how to deal with PDF file format attacks in any organization's 2010 security to-do lists. But no matter what the final decision is, it is essential to update to the latest software version, use an alternative PDF reader that is less scrutinized by attackers, perhaps just uninstall the software, and create an inventory of existing installed version. All modern vulnerability management tools cover Adobe Reader vulnerabilities and provide that inventory mechanism. Typical system management solutions also offer a way to catalog installed software; a number of free programs also are available that can help a smaller organization's needs.

-- As the CTO for Qualys, Wolfgang Kandek is responsible for product direction and all operational aspects of the QualysGuard platform and its infrastructure. Wolfgang has more than 20 years of experience in developing and managing information systems. His focus has been on Unix-based server architectures and application delivery through the Internet. Wolfgang provides the latest commentary on his blog: laws.qualys.com and also publishes his Patch Tuesday commentary to the QualysGuard channel: www.youtube.com/QualysGuard. He is a frequent source in business and trade media and speaks at industry conferences around the world, most recently at RSA 2009.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4147
PUBLISHED: 2019-09-16
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413.
CVE-2019-5481
PUBLISHED: 2019-09-16
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CVE-2019-5482
PUBLISHED: 2019-09-16
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-15741
PUBLISHED: 2019-09-16
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation
CVE-2019-16370
PUBLISHED: 2019-09-16
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.