Adobe has acknowledged that some users are vulnerable to attack after downloading an outdated version of Reader from its Web site, and said it is now reevaluating how it updates the popular PDF reader.
Yesterday, Brad Arkin, Adobe’s director for product security and privacy, responded to claims by Danish security vendor Secunia that the currently-available version of Reader contains numerous bugs, and that Adobe’s update process can leave users vulnerable for days or even weeks.
“We do single-dot releases, such as [Reader] 9.1, as full installers,” explained Arkin, referring to the version Adobe released in mid-March to plug several holes, including one that had been exploited by hackers since early January. “The double-dot releases, like 9.1.1 and 9.1.2, those are for patches only and work only with a full-installed version in place.”
The single-dot releases, such as Reader 9.1, must meet a different quality level for testing than the patch releases. Doing it that way will “get security fixes faster to users,” Arkin said. “That helps keep users up-to-date.”
Patch-only updates are common in software, but the problem with Adobe’s practice is that it continues to provide an out-of-date edition that many times isn’t updated with the latest patches, argued Secunia on Monday. Adobe has issued two security updates since Reader 9.1’s debut. The first, released May 12, patched a “zero-day” bug in Reader, while the second, issued June 9, fixed 13 or more flaws.
“Adobe does have the Adobe Updater, which will eventually update Reader to the patched versions,” said Mikkel Winther, the manager of Secunia’s PSI partner program yesterday. “But sometimes it takes days or weeks for the updater to come up.”
By default Adobe’s updater pings the company server once a week.
Adobe’s Arkin admitted that the updater doesn’t always work as it’s supposed to.
“The intended behavior of the updater is that when you launch Reader for the first time, it will check if there are any updates available,” he said. “That’s its intended behavior, but there are a lot of [PC] configuration factors that might lead to different behavior.”
Arkin confirmed that a first-launch of Reader sometimes fails to trigger Adobe’s updater on PCs in its own labs. The updater failed to appear after launching Reader 9.1 for the first time on three different Windows PCs that Computerworld tested.
Abode is also reevaluating how frequently its software updater pings the company’s servers to see whether a patch is ready for download. Currently, the updater defaults to weekly intervals, with monthly intervals the only other option.
“We decided that’s the right amount of time after feedback from enterprises,” said Arkin. He declined to specify what changes Adobe is considering for the updater, and whether those may involve more interval choices for users or a shorter interval, perhaps a daily check for updates, that would be set by default.
“Security patching is also part of the overall security process,” Arkin said.
Two months ago, Adobe announced it had seen the security light, and promised it would root out bugs in older code, speed up the patching process and release regular security updates for Reader. The first quarterly update was issued last month.
Patching the exploit is critical, says analyst
Hackers continue to hammer Reader. According to New York-based CA today, there are “a vast number of malicious PDF files in circulation on the Internet,” many of them pitching multiple exploits at Windows users.
The Adobe update should be at the top of people’s to-do list, a security expert said today.
“Adobe’s is more important than Microsoft’s,” said Wolfgang Kandek, chief technology officer at Qualys. “Even though Microsoft’s had more visibility, if you have to choose between the two, you should patch Adobe. [Reader] is pretty much everywhere, attackers are increasing exploiting it and [PDF] is a widely-used corporate format.”
The Reader vulnerability has been patched for all platforms in the free Reader 8 and 9, as well as in the corresponding versions of Adobe Acrobat, the for-pay PDF creation and editing application, the company said Tuesday.
Adobe’s security advisory did not spell out the nature of the vulnerability, but earlier the company’s security team had recommended that users disable JavaScript, indicating that the flaw was another bug in those applications’ implementation of the scripting language.
Lack of detail is nothing new for Adobe’s advisories; in March, when it patched another JavaScript bug in the same software, it also refused to provide anything more than general information because, while it had issued some updates, it had not managed to patch every version.
Adobe has staged updates in the past; in March the company said that waiting until all patches were ready for the February bug “just didn’t make sense.”
According to data from Finnish security company F-Secure, patching PDF bugs is critically important. So far this year, of the 663 targeted attacks F-Secure’s uncovered — targeted meaning attacks aimed at specific organizations or companies, or even individuals — nearly half of them have relied on exploits of Adobe Reader vulnerabilities.
In the first four months of 2009, 48.9% of all targeted attacks involved a malicious PDF file attached to a legitimate-looking e-mail, said F-Secure, a dramatic change from 2008, when PDFs made up just 28.6% of target attacks.
Previously, exploits of bugs in Microsoft Office’s applications — Word, Excel and PowerPoint — made up the bulk of attacks.
Source: Computerworld.com