Oct 14, 2009 (01:10 PM EDT)
Adobe Fixes 29 Flaws In Acrobat And Reader
Read the Original Article at InformationWeek
Microsoft wasn't the only company issuing a major security patch on Tuesday.
Adobe released a fix for 29 vulnerabilities in its Acrobat and Acrobat Reader software, warning that the vulnerabilities could be exploited to cause crashes and to take control of the user's computer.
Adobe rates the update as "crtical" and warns that one of the vulnerabilities (CVE-2009-3459) is actively being exploited.
A successful attack results in the installation of a backdoor that provides the attacker with unrestricted user-level access.
Affected software includes Adobe Reader 9.1.3 and Acrobat 9.1.3, Adobe Reader 8.1.6 and Acrobat 8.1.6 for Windows, Macintosh and UNIX, and Adobe Reader 7.1.3 and Acrobat 7.1.3 for Windows and Macintosh.
Updated software will become version 9.2, 8.17, or 7.14.
Adobe's software has become a popular target for cyber criminals because of its broad distribution.
According to the 2009 Top Cyber Security Risks report, released in September by the SANS Institute, "'File Format Vulnerabilities' continue to be the first choice for attackers to conduct zero-day and targeted attacks. Most of the attacks continue to target Adobe PDF, Flash Player and Microsoft Office Suite (PowerPoint, Excel and Word) software."
Adobe's Acrobat and Reader software accounted for four of the top 30 vulnerabilities cited in the report, with four more spots going to Adobe's Flash software.