SmallBizResource Blog -- Security

Adobe Patches Critical Reader Flaw

Posted by Gayle Kesten Tuesday, Nov 4, 2008, 05:53 PM ET

Better check which version of Adobe Reader you're running. If, like mine, it's 8.1 or earlier, you might want to think twice before opening a PDF.

According to a security bulletin posted today: "Critical vulnerabilities have been identified in Adobe Reader and Acrobat 8.1.2 and earlier versions. These vulnerabilities would cause the application to crash and could potentially allow an attacker to take control of the affected system."

Behind the scenes, Adobe Reader suffers from a stack buffer overflow when parsing specially crafted (invalid) PDF files. The flaw could be exploited if a user is tricked into opening a rigged PDF file. According to Dark Reading, the flaw was discovered by researchers at Core Security Technologies who were studying another similar flaw in a different PDF view application, Foxit Reader.

OK, enough of the scary stuff. Here's what we need to know so we can fixate on our businesses (not to mention tonight's election coverage) instead of our computers:

• Adobe recommends upgrading to Adobe Reader 9, which was released in June. You can download it from here.
• If you're unable to upgrade to Reader 9, then you should update to Reader 8.1.3. Choose your operating system and you're good to go.
• A third option -- really more of a workaround: Disable JavaScript in Adobe Reader and Acrobat (in the Edit/Preferences menu). Doing so will prevent the issue, although it will also prevent many basic Acrobat and Reader workflows from properly functioning.

Security