Microsoft Office 2007 US-CERT Technical Cyber Secu

Home | FAQ | Contact | Privacy & Use
Adobe Reader and Acrobat Affected by Multiple Vulnerabilities Original release date: October 06, 2010
Last revised: --
Source: US-CERT
Systems Affected
Adobe Reader 9.3.4 and earlier versions for Windows, Macintosh, and
UNIXAdobe Acrobat 9.3.4 and earlier versions for Windows and
MacintoshAdobe Reader 8.2.4 and earlier versions for Windows,Windows 7 Key,
Macintosh,Microsoft Office 2007, and UNIXAdobe Acrobat 8.2.4 and earlier versions for Windows
and Macintosh
Overview
Adobe has released Security Bulletin APSB10-21,
which describes multiple vulnerabilities affecting Adobe Reader and Acrobat.

I. Description
Adobe Security Bulletin APSB10-21
describes a number of vulnerabilities affecting Adobe Reader and Acrobat. These
vulnerabilities affect Reader and Acrobat 9.3.4,Office 2010 Activation, earlier 9.x versions, 8.2.4,
and earlier 8.x versions.
An attacker could exploit these vulnerabilities
by convincing a user to open a specially crafted PDF file. The Adobe Reader
browser plug-in, which can automatically open PDF documents hosted on a website,
is available for multiple web browsers and operating systems.
Additional
information is available in US-CERT Vulnerability Note VU#491991.

II. Impact
These vulnerabilities could allow a remote attacker to execute arbitrary
code, write arbitrary files or folders to the file system,Microsoft Office 2007 Professional, escalate local
privileges, or cause a denial of service on an affected system as the result of
a user opening a malicious PDF file.

III. Solution
Update
Adobe has released updates to address this
issue. Users are encouraged to read Adobe Security Bulletin APSB10-21
and update vulnerable versions of Adobe Reader and Acrobat.
Disable
JavaScript in Adobe Reader and Acrobat
Disabling JavaScript may
prevent some exploits from resulting in code execution. Acrobat JavaScript can
be disabled using the Preferences menu (Edit -> Preferences
-> JavaScript; uncheck Enable Acrobat
JavaScript).
Adobe provides a framework to blacklist specific
JavaScipt APIs. If JavaScript must be enabled, this feature may be useful
when specific APIs are known to be vulnerable or used in attacks.

Prevent Internet Explorer from automatically opening PDF files

The installer for Adobe Reader and Acrobat configures Internet Explorer to
automatically open PDF files without any user interaction. This behavior can be
reverted to a safer option that prompts the user by importing the following as a
.REG file:
Windows Registry Editor Version
5.00

[HKEY_CLASSES_ROOT\AcroExch.Document.7]
"EditFlags"=hex:00,00,00,00
Disable the display of PDF
files in the web browser

Preventing PDF files from opening
inside a web browser will partially mitigate this vulnerability. If this
workaround is applied, it may also mitigate future vulnerabilities.

To prevent PDF files from automatically being opened in a web browser, do the
following:

1. Open Adobe Acrobat Reader.
2. Open the
Edit menu.
3. Choose the Preferences option.
4.
Choose the Internet section.
5. Uncheck the "Display PDF
in browser" checkbox.

Do not access PDF files from
untrusted sources

Do not open unfamiliar or unexpected PDF
files, particularly those hosted on websites or delivered as email attachments.
Please see Cyber Security Tip ST04-010.

IV. References
Security update available for Adobe Reader and Acrobat - <
Vulnerability Note VU#491991 - <
Reader and Acrobat JavaScript Blacklist Framework - <

Feedback can be directed to US-CERT.

Produced 2010 by US-CERT,Office Professional 2010, a government organization. Terms of use

Revision History
October 06, 2010: Initial release