Adobe Warns of Critical Zero Day Vulnerability

wiredmikey writes "Adobe issued an advisory today on a zero-day vulnerability (CVE-2011-2462) that has come under attack in the wild. According to Adobe, the issue is a U3D memory corruption vulnerability that can be exploited to cause a crash and permit an attacker to hijack a system. So far, there are reports the vulnerability is being exploited in limited, targeted attacks against Adobe Reader 9.x on Windows. However, the bug also affects Adobe Reader and Acrobat 9.4.6 and earlier 9.x versions for UNIX and Macintosh computers, as well as Adobe Reader X (10.1.1) and Acrobat X (10.1.1) and earlier 10.x versions on Windows and Mac. Patches for Windows and Mac users of Adobe Reader X and Acrobat X will come on the next quarterly update, scheduled for Jan. 10, 2012."

Comments

Listed mitigation: Adobe Reader X Protected Mode

[Anonymous Coward]

Why on earth isn't "Adobe Reader X Protected Mode" the default?

Patched when?

[binaryhat]

Jan. 10, 2012? Why not immediately? Do Adobe coders suck that bad... Honestly I think when a major vulnerability is found, companies should fix it immediately or face penalties.

A lack of diversity...

[jenningsthecat]

...leads to increased vulnerability, whether in biology or in software.

Although there are alternatives to Adobe Reader, none of them is good enough to gain significant market share. And Adobe does everything it can to make competing with it more difficult. So a key piece of software used by a large majority of computer users is bloated beyond belief and so riddled with vulnerabilities that it seems there's a new every day. It sucks, but it's hardly surprising.

On the web, as in politics, we get what we deserve - or, in this case, we get what other web users deserve, because they vastly outnumber us.

Re:A lack of diversity...

[Mad Merlin]

Although there are alternatives to Adobe Reader, none of them is good enough to gain significant market share.

Are you kidding me? Acrobat is such a steaming pile of crap that it has bred a completely misplaced hatred of PDF in most Windows users. Ever seen a Slashdot summary with a "(warning, PDF)" note after a link? Only Acrobat can manage to bog down a brand new system opening a 1 page PDF, every other PDF reader in the world will open it instantaneously.

If anything, Acrobat has single handedly painted PDF into the very niche corner that it's in now. PDF is a good format hobbled by a hopelessly lousy reference implementation.

Look at the credits for Adobe Reader.

[Anonymous Coward]

If you're wondering "How can this happen?", all you need to do is look at the credits of Acrobat Reader. Notice that many of the names are quite clearly Indian. Then it all makes sense.

Re:Look at the credits for Adobe Reader.

[Anonymous Coward]

Because anytime you single out a creed, religion, race, or other general status, anyone belonging to said group interprets it as a personal attack and employs all possible methods to censor the shit out of said perceived attacker. It's like a biological kill-switch.

Re:Look at the credits for Adobe Reader.

[hipp5]

Because there is an assumption implicit in his post that that Indian names = outsourced, two-bit programmers in an Indian code sweatshop. The statement that names in the credits are Indian is indeed true. The broad assumption that follows is wild conjecturing with weak evidence and is thus deserving of a down mod.

Re:Look at the credits for Adobe Reader.

[MechaStreisand]

What's more likely, a large number of Indian names referring to Adobe's US center which is largely Indian-Americans for no reason, or a large number of Indian names referring to Indians, in India? Furthermore, what is the primary reason American companies hire Indian programmers in India? Quality? Or is there some other reason, perhaps relating to their cost?

Re:Look at the credits for Adobe Reader.

[Anonymous Coward]

The term you're looking for is "fact", not "assumption".

The industry as a whole has now had 10 to 15 years of experience with Indian software developers. That's actually quite a long time, given the relatively young age of the industry. Yet for every successful project we hear about, there are literally tens of thousands of horror stories. That's clearly not a balanced ratio.

There comes a point when repeated and consistent observations must be accepted as the truth, even if this may be a painful truth to accept. Reoccurring trends start to indicate the norm. In this case, the norm is that Indian-developed software is very typically of an inferior quality, riddled with bug and security flaws.

You talk about "wild conjecture" and "weak evidence", but every observation and every shred of experience we have show quite the opposite. There's a reason why Indian developers as a whole have a bad reputation; it's because they have fucked up software projects again and again and again and again and again and again and again and again and again and again and again.

Re:Look at the credits for Adobe Reader.

[hairyfeet]

Exactly. Nobody is saying the Indians are shit, they are saying that companies that take the lowest priced shit get shit for their money and when we see Indian coders that is EXACTLY what we are seeing, why try to hide it? Good Indian coders cost good money, same as good coders anywhere. These companies don't go to India because they want to hire top notch Indians at a decent wage, these corps want as close to sweatshop as they can possibly get. you know this, i know this, hell didn't anybody watch "How NOT to hire an American"? These corps don't give a shit about quality, its all about cost. This is why our landfills are overflowing with cheap plastic garbage and people are being poisoned in China melting circuit boards for the metals, cheap ass bottom of the line shit. this is just cheap ass bottom of the line software instead of hardware and India is where you go to get a programmer for a price lower than dinner at Mickey D.

As for TFA this is why i'm so glad i haven't included Adobe Reader on a build of mine since Adobe 6. There are several excellent alternative readers like foxit and sumatra and foxit comes with safe reading on by default, so why would you want the risk that Reader causes? With Flash sandboxed in low rights mode and no reader i don't have to worry about Adobe bugs, which is nice. You'd have to be nuts to want Reader unless you simply have no other choice.

Re:Look at the credits for Adobe Reader.

[EdIII]

You'd have to be nuts to want Reader unless you simply have no other choice.

Acrobat 10. Production environment. Multiple servers for remote desktop sessions. Have to have it. Receive secure documents all the time for markup and endorsements and Foxit can't even open it. Let's not even talk about 3rd party PDF support for electronic signatures from capture pads.

The NERVE of those fuckers to announce a zero-day exploit in the wild with an expected fix date in a quarterly update.

What the fuck are they smoking? It's the 6th of December you sadistic moronic fucktards. This is the dark side of vendor lock-in. Till that update I have to wonder about the thousands of PDF documents flowing through into the system and from emails. Believe me, there are some workers that will open anything in an email. So it is a real risk already.

Not that I don't normally, but there is a big difference between a possible threat and a known one.

It's just amazing for them to announce that with all the business customers they have. The unmitigated gall of those bastards.

Re:Look at the credits for Adobe Reader.

[shuttah]

I agree 110%.

It's a blatant and inexcusable display of negligence on Adobe's part to schedule an update over a month after telling us that a REMOTE EXECUTION EXPLOIT is confirmed, and is being exploited in the wild. Again, with confirmation. To add to that, this isn't even something where you can advise everyone to turn off javascript and pray everyone follows your instructions while keeping an eye on traffic. It's nothing short of nightmare to be honest. The fact that this software is installed on everything from a consumer's new laptop or desktop, to a hell of a lot of government agencies doesn't sit well with me either.

Re:Look at the credits for Adobe Reader.

[Anonymous Coward]

I know plenty of Indian programmers who got their H1B visas, live in America, and write shitty code. They are valued because they can churn out products quickly, but for a very costly maintenance value. YMMV - there are plenty of developers of all races that write shitty code.

Re:Look at the credits for Adobe Reader.

[FooAtWFU]

I'm going to agree mostly, but differentiate a little. I have actually worked with a couple of very talented Indian software engineers - more talented and experienced than myself, sometimes. They weren't working for an outsourcing company, though; they were full-time hires. Good Indian software engineers have a tendency to go the same places good American software engineers do: companies that value their talent and who are willing to pay for it. They just have a marginally harder time doing it due to US immigration law. (Myself, I'd rather have them fully naturalized as soon as reasonable - I can compete with them better when their wages haven't artificially depressed by the monopsonistic exploitation of their labor associated with the immigration game).

Anyway. It's already a lot easier to find a lousy software developer than to find a good one here in the US. Outsourcing to India as part of a management-driven process? Yeah, I'm going to laugh at the quality of the results in advance, please. As for Adobe employees working on Acrobat... let's just say their product doesn't do too much to promote the idea that they're competent.

Re:FYI: U3D = Universal 3D

[Mojo66]

Why do we need support for 3D files, embedded file attachments, JavaScript and all that crap in a file format that was originally intended to print documents? I'm glad that there are alternativs to Adobe Reader that just support the old idea of a printable document file format and nothing more, for example Preview on OS X, for other OS see this list. The crazy thing is that Adobe Reader is promoted by a lot of companies that use PDFs to send out bills electronically, i.e. to open the attachment, you need to download Acrobat Reader. Which is not only a wrong statement, but also a suggestion to install an application that has been plagued with security faults.

Re:Listed mitigation: Adobe Reader X Protected Mod

[smpoole7]

Most of our technical manuals come in PDF form now, but thank God for Okular. It has really, really improved. :)

Good God

[tsotha]

It's a freakin' document reader. How did Adobe end up here? Not only is it such a bloated piece of crap it takes forever to open a document, but they seem to have one vulnerability after another. The functionality that they added for 0.0000001% of their customers isn't really worth the price they're paying.

Re:Listed mitigation: Adobe Reader X Protected Mod

[hairyfeet]

Hey I don't have a problem with you being on XP friend, if it works why fix it? I have windows 7 on one machine and XP on another, why bother switching the older XP machine?

My question would be why are you trying to run Adbobe reader at all when there is both Foxit and Sumatra on Ninite. Just check the box, click the download button and run it, that's it. then you can say goodbye to crappy Adobe Reader.

As for why Adobe can't build a secure reader? you answered it yourself friend when you said you thought it was " one program to do basically one simple enough thing" when to try to sell copies of Acrobat Adobe has been piling shit into that program for years. That is why frankly for production software like Acrobat i really wish they'd go to a yearly license model like AV companies use. that way instead of being pressured to constantly add new shit to the program so they have an excuse to upsell you they could just focus on making it better and more secure and get paid without having to add crap.

Re:Listed mitigation: Adobe Reader X Protected Mod

[capnkr]

"Blob" is very apt terminology, yet "(Unecessarily) Giant Blob" might be even more accurate. Not sure if these are exact numbers, but they are probably close. From Wikipedia, re: Sumatra PDF:

It has a 4.4 MB setup file, compared to Adobe Reader's 40.5 MB, for Windows 7. Installed size is 8.4 MB, whereas Adobe Reader requires 335 MB of available disk space.

Adobe PDF Reader - now with 10-40x the size of what's *really* needed! ***Bonus*** - Includes Critical 0 Day vulnerability, @ no extra charge!!!

What more could you ask for?

Attack surface

[WD]

I wrote it years ago, but it's still quite relevant:
http://www.cert.org/blogs/certcc/2009/06/vulnerabilities_and_software_a.html

Coding quality and exploit mitigations aside, there's something to be said for the size of the software that you're installing. The more code that's there, the more there is to attack. If you're using Reader, you might ask, why is there a 3D rendering engine in my PDF reader? Or maybe even do something about it.

I *prefer* non-conforming

[Mathinker]

> you must distinguish the difference between conforming and non-conforming implementations of PDF before comparing

Your point is valid, however, how much of that ISO standard is, itself, "ooooh, shiny"-ness which is one of the reasons why Reader has so many more possible places of failure? Before discovering better alternatives for reading PDFs under Windows, the first thing I would do to Adobe Reader was to disable scripting support inside PDF documents.

In other words, I prefer the non-conforming, because that means that (there is a chance that) the implementers might actually be ignoring stupid things which Adobe pushed into the PDF standard which shouldn't be there.

Re:Listed mitigation: Adobe Reader X Protected Mod

[Bert64]

It's the old Microsoft syndrome again...
Take software which was designed for a non networked, single user standalone environment...
Throw it onto a hostile network like the Internet...
Then make sure that 95% of systems run exactly the same software...

If there was a more even marketshare of PDF viewers out there, then they would be far less attractive to target.