Microsoft Helps Adobe Block PDF Zero-Day Exploit

CWmike writes "Microsoft has urged Windows users to block ongoing attacks against Adobe's popular PDF viewer by deploying one of Microsoft's enterprise tools. Adobe echoed Microsoft's advice, saying the Enhanced Migration Experience Toolkit (EMET) would stymie attacks targeting Reader and Acrobat. Called 'scary' and 'clever,' the in-the-wild exploit went public last week when security researcher Mila Parkour reported it to Adobe after analyzing a rogue PDF document attached to spam. Adobe first warned users Wednesday of the threat, but at the time gave users no advice on how to protect themselves until a patch was ready. Microsoft stepped in on Friday. 'The good news is that if you have EMET enabled ... it blocks this exploit,' said Fermin Serna and Andrew Roths, two engineers with the Microsoft Security Response Center in an entry on the group's blog." A Symantec blog post suggests the people exploiting this vulnerability may be the 'Aurora' group responsible for the attacks on Google late last year.

Comments

I already fixed mine

[mcgrew]

I ununstalled Adobe Reader and installed Foxit. Problem solved!

Re:I already fixed mine

[VGPowerlord]

As long as you don't assume it's a panacea... Foxit has had its own security exploits in the past.

Re:I already fixed mine

[revlayle]

Foxit insists on installing toolbars and special search engines these days... don't like it one bit.

Re:I already fixed mine

[vux984]

Toolbars? Search engines? Are we talking about the same program here?

Yes.
It wants to install the Foxit Search Bar powered by Ask (opt-out)
It wants to set ask.com as your home page (also opt-out)

I just downloaded the most recent zipped version for Windows last night, and it didn't even need an installer.

Right. That's hardly how most people install the software.

Past versions that I've used the installer version of, had a rather obvious checkbox that you could use to opt out of installing a toolbar.

Oh, so you know all about the toolbar crap, and you are just being disingenuous. Classy.

Bottom line this sort of behaviour is skirting the border of being malware. What percentage of users appreciate another toolbar being crammed into their browser? What percentage of users appreciate their home page being changed? When both are pretty close to zero, you don't make it OPT-OUT in your installation wizard. Its especially obnoxious when users have to keep opting out each time they install an update.

Having an opt out toolbar or home page change as part of the default install is obnoxious enough for me to avoid recommending foxit. Too many people will end up with them and none of them will appreciate it.

Re:Its not zero day ...

[mcgrew]

When you're well past a week old, why the fuck do you keep calling it 0 day?

Because it was exploitable on day zero. It's a week old zero day exploit.

Adobe's perspective

[alvinrod]

What does it say about your company when another company has to clean up your mess while you stand around, thumb up ass, not appearing to be doing anything meaningful?

This has nothing to do about MS being good or evil. They've got a solution to the problem and it's much welcomed. Hopefully Adobe gets this fixed shortly so that people who can't make use of Microsoft's solution don't have to worry about the vulnerability either.

Re:What does it say about your company...

[just_another_sean]

This is /. Anything related to computer security is news. Especially when it effectivaly targets most, if not, all the users/customers we have to help all day (and night, and weekends!).

Not every story about Microsoft is posted just because it's about Microsoft.

Re:Publicity is publicity

[b4dc0d3r]

Every time a news article says there's a flaw in Acrobat Reader and that everyone is vulnerable, it reinforces the idea that everyone uses Acrobat and there is no other option.

No such thing as bad publicity, bandwagon propaganda, and all that. They might as well put flaws in on purpose for the free monthly advertising. All it takes is a tiny portion of flaws to appear in Foxit, which does happen sometimes, and Adobe gets to claim that no reader is flaw-free.

ASLR

[js3]

According to the article..

  "Normally Address Space Layout Randomization (ASLR) would help prevent successful exploitation. However, this product ships with a DLL (icucnv36.dll) that doesn’t have ASLR turned on."

So enable ASLR on the effing DLL and release a patch, problem solved? Nothing would make me work overtime and on the weekend than a highly visible level 1 bug. Adobe developers must have it good!