Posted 10/13/09 at 07:02:36 PM by Ryan Whitwam

Security flaws in Adobe reader and Acrobat are nothing new, but in a recent round of updates, Adobe has patched 29 vulnerabilities at once. The updates also included a new software updater that should, once activated, deliver patches in a more effective way.

This will be a welcome change for anyone that’s had to use the current updater. It only checks for updates to Adobe software weekly, and given the frequency of exploits in their products, it isn’t enough. Some updates would even mysteriously vanish from the updater, leaving users vulnerable. This should all change with the new version.

The other vulnerabilities addressed in the set of patches revolved mostly around remote code execution attacks. One of which was already in use around the internet. Adobe warned Mac and Unix users that the same vulnerabilities exist on their platforms as well. The internet is a dangerous place.

Read More

Posted 06/11/09 at 07:11:41 PM by Mark Edward Soper

June 9th saw a rare 'double-header' in security updates: Microsoft's monthly Patch Tuesday was joined by Adobe's quarterly security updates for Acrobat and Adobe Reader. How big was this month's 10-update Patch Tuesday? According to a Microsoft spokesperson quoted by Cnet, the 31 vulnerabilities covered by updates are "the most since Microsoft started releasing updates on a regular schedule of the second Tuesday of every month in October 2003."

Users of Windows 2000 SP4 through Windows Vista SP2 (and holdouts still running Windows 7 Beta), Microsoft Office 2000, 2003, or 2007; Microsoft Office for MacOS 2004 and 2008, Microsoft Works 8.5 and 9, and IE5.01 through IE8 users have some work to do before heading off on vacation, as do users of Adobe Reader and Acrobat 7.x, 8.x and 9.x. To find out what's being changed - and why - join us after the break.

Read More

Posted 03/15/09 at 12:59:32 PM by Justin Kerr

If you haven’t done so already, make sure your Adobe reader has checked for, and downloaded the latest updates. Adobe has finally released a patch for the zero day scripting vulnerability in its PDF software. The patch for version 9 hit the net a bit earlier than expected, but not a moment too soon to combat this now critically exploited weakness which has been in the wild now since December 2008. The patches for Version 7 & 8 are still planned for March 18th and users of this version would be advised to either upgrade to 9.1 or consider Foxit Reader.

The news was posted by Adobe blogger David Lenoe. "Today, we posted the Adobe Reader 9.1 and Acrobat 9.1 update, which resolves the recent JBIG2 security issue (CVE-2009-0658), including the 'no-click' variant of the vulnerability." "We encourage all Adobe Reader users to download and install the free Adobe Reader 9.1."

For those that haven’t been following the details of the exploit, the vulnerability is a result of an array indexing error in the processing of JBIG2 streams. Hackers have found a way to corrupt arbitrary memory using the PDF format and take control of compromised systems. The lesson learned here if we didn’t know it already, don’t take candy, or PDF’s from strangers.

Read More

Posted 02/22/09 at 06:41:26 PM by Justin Kerr

Adobe’s PDF reader and creator software continues to be under a seemingly endless attack, and a new vulnerability has the security community very worried. A critical flaw in all editions of its PDF reader and creator software will allow attackers to crash the application and gain control of a person’s computer. This vulnerability has been acknowledged by Adobe, but a fix is still rumored to be 2-3 week away. Initially the company will be working to patch version 9, but will eventually include fixes for version’s 7 & 8 as well.

According to the McAfee security blog, malicious PDF documents are already in the wild, and have been appearing across the web since early January. PDF exploits are of significant concern to the security community since the reader software interfaces very closely with web browsers. In many cases PDF documents are opened within a new browser tab, and displayed even with a user’s consent.  According to Symantec this attack has primarily been directed towards government agencies and large corporations, it is not widespread as of yet.

Symantec also offers some tips on how to combat the problem by disabling JavaScript, but here at Maximum PC we much prefer just using Foxit Reader as an alternative. This lightweight solution weighs in at only 3 MB and (to the best of our knowledge) is unaffected by the exploit. It’s so good in fact, it made our list of 32 Totally Essential (and free) Apps for Every New PC.

Read More

Posted 06/26/08 at 03:54:34 PM by Mark Edward Soper

New Acrobat 9 adds built-in Flash and multimedia support to the venerable PDF format. That's the good news. The bad? Unless you buy (or try) Acrobat 9, you can't enjoy any of the new multimedia goodies in PDF documents just yet.

To find out what's new, how to buy (or try) your favorite version of Acrobat 9, and to learn when Reader will catch up, read on.

Read More

Posted 06/02/08 at 11:29:53 PM by Mark Soper

Want to try something new (and maybe not quite ready for prime time)? Microsoft and Adobe have some cool new products to try - if you dare.

Read More

Posted 10/22/07 at 10:55:31 PM by Mark 'Marcus Soperus' Soper

... the "Mailto" URI vulnerability fix, that is. Find out how to get the updates and learn which Acrobat and Reader users are still at risk.

Read More

Posted 10/12/07 at 07:57:20 AM by Mark 'Marcus Soperus' Soper

Put Adobe Acrobat or Adobe Reader together with Windows XP and Internet Explorer 7, and what do you have? A significant threat to your PC. Learn how to protect yourself.

Read More