It's presently possible to run exploit code via Adobe Acrobat Reader 
via PDFs in emails or on websites.

        http://computerworld.co.nz/news.nsf/scrt/5357F78B0E30E3B5CC25736F006A6F22?opendocument&utm_source=topnews&utm_medium=email&utm_campaign=topnews

Note that this class of exploit is as applicable to bith Firefox and 
Explorer (at least).


        Russell


__________________________________________________________

October 10th

Adobe Systems has confirmed that there's a critical bug in its most 
popular programs, but it doesn't yet have a patch that protects 
Windows XP users against attacks arriving as PDF files.
In an advisory posted on Friday, Adobe admitted that the flaw first 
disclosed by Petko Petkov, a UK-based security researcher, was real. 
The San Jose-based company also provided a multiple-step work-around 
in lieu of a permanent fix to its Adobe Acrobat software and its free 
Adobe Reader application.

Last month, Petkov claimed in a blog posting that he had found a 
critical vulnerability that could be leveraged using PDF files, 
Adobe's popular document format. "Adobe Acrobat/Reader PDF documents 
can be used to compromise your Windows box," Petkov said Sept. 21 
"Completely!!! Invisibly and unwillingly!!! All it takes is to open a 
PDF document or stumble across a page [that] embeds one."

At the time, Petkov declined to provide proof-of-concept code, telling 
users: "You have to take my word for it." He recommended steering 
clear of all PDFs until a fix was available.

Adobe's work-around requires editing the Windows registry, a daunting 
chore for most users, but it will protect against malicious PDF 
documents that exploit the "mailto:" URI (universal resource 
identifier) to trick users into downloading attack code. Mailto:, one 
of the most-frequently used URIs, launches the default email client 
and opens a pre-address message when a link is clicked inside a web 
browser.

The terse description indicates that the PDF vulnerability is yet 
another protocol-handling bug. Those flaws have been a hot topic in 
security circles since July, when another researcher, Norwegian Thor 
Larholm, showed how Internet Explorer and rival Firefox could be used 
to run malicious code by exploiting invalid URIs. In fact, the debate 
over patching responsibility resumed on Friday, when a German analyst 
said IE7 brought new bugs to Windows XP.

Juergen Schmidt of Heise Security specifically called out Adobe's 
software in a warning to a security mailing list, while Heise's 
website provided a proof-of-concept attack that used the mailto: URI 
to inject malicious code via a PDF. "This critical security problem is 
probably the same as recently detected and described by Petko Petkov," 
Heise said on Friday before Adobe published its advisory.

Adobe said it would update Adobe Reader 8.1 and Adobe Acrobat 8.1, as 
well as Adobe 3D, by the end of the month, but did not give a more 
specific date.

Microsoft, which has been criticised for not fixing the 
protocol-handing capabilities in Windows and Internet Explorer, has 
repeatedly said that the responsibility for making sure third-party 
software properly processes URIs such as mailto: falls to other 
vendors' application developers, not its engineers. In July, IE 
program manager Markellos Diorinos claimed that it would be "very 
difficult" for Windows to check for possibly invalid URIs.

If users cannot or will not use the work-around, Adobe's advice was 
essentially the same as Petkov's of two weeks ago. "Adobe recommends 
that Acrobat and Reader customers use caution when receiving 
unsolicited email communications requesting user action, such as 
opening attachments or clicking web links," the company said in its 
advisory.

Only Windows XP users running Internet Explorer 7 are at risk, Adobe 
said. Owners of Windows Vista, which sports its own version of IE 7, 
are safe from the mailto:-based attacks.

-- 
http://www.piclist.com PIC/SX FAQ & list archive
View/change your membership options at
http://mailman.mit.edu/mailman/listinfo/piclist