Critical Adobe PDF Vulnerability: Disable JavaScript!

No relief appears to be in sight as far as Adobe product vulnerabilities this year. Here is hope that 2010 proves better for Adobe security.

In the meantime, however, there is yet another vulnerability in Adobe Reader and Adobe Acrobat 9.2, including all earlier versions, being actively exploited in the wild. although the exploit is actively being used by attackers, at this time the number of attacks are limited. This is expected to change within the next few weeks.

All users of Adobe Reader and Adobe Acrobat 9.2 are strongly encouraged to incorporate the suggested workaround by disabling JavaScript in Adobe PDF Reader/Acrobat:

Click: Edit -> Preferences -> JavaScript and uncheck Enable Acrobat JavaScript

For home use, you may wish to replace Adobe Reader with an alternate PDF reader. Other options are available at http://pdfreaders.org/.

Update: Adobe PSIRT announced plans to issue an update to Adobe Reader and Acrobat by January 12, 2010. In addition, the official Security Advisory was posted at Adobe - Security Advisories: APSA09-07

References:

• Adobe Product Security Incident Response Team (PSIRT): New Adobe Reader and Acrobat Vulnerability
• Threatpost: How to mitigate Adobe PDF malware attacks
  
• National Vulnerability Database (NVD): (CVE-2009-4324)
• ZDNet.com: Adobe confirms PDF zero-day attacks. Disable JavaScript now

Clubhouse Tags: Clubhouse, Security, Updates, Vulnerabilities, Adobe

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...