Software // Enterprise Applications
News
11/30/2006
12:56 PM
Connect Directly
RSS
E-Mail
50%
50%

Adobe Warns Of Critical Acrobat, Reader Bugs

The critical unpatched bugs could be used by attackers to seize control of Windows PCs running Internet Explorer, Adobe warns.

Adobe Systems Inc. warned users of its popular Acrobat and Reader software that critical unpatched bugs could be used by attackers to seize control of Windows PCs running Internet Explorer.

The bugs, which both Adobe and FrSIRT, a French vulnerability tracker, labeled as "critical," are in the AcroPDF ActiveX control, the component of Adobe Acrobat and Adobe Reader that displays PDF documents within Internet Explorer. The Windows versions of both applications starting with v. 7.0.0 and running through the current v. 7.0.8 are flawed, said Adobe, but only users browsing with Microsoft's Internet Explorer are at risk. "Users of other browsers are not affected," Adobe said in a security advisory it posted on its site Tuesday.

The most likely exploit of the bugs would involve a malicious PDF file posted to a Web site or sent to users as an e-mail attachment. Users would have to be duped into clicking on a download link to a malformed PDF document or opening a malicious attachment.

Adobe said it was working on a patch, which would be included in Acrobat and Reader updates "in the near future." In the meantime, the company recommended that users eliminate the flawed ActiveX control by deleting the "AcroPDF.dll" file. With the .dll deleted, IE users will not be able to view PDF documents within the browser; instead, documents will open within Adobe Reader or the user will be prompted to download the file.

FrSIRT advised users that they could also protect their PCs by setting a "kill bit" in the Windows registry to disable the vulnerable ActiveX control.

Comment  | 
Print  | 
More Insights
Building A Mobile Business Mindset
Building A Mobile Business Mindset
Among 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps and it's past time for those with no plans to get cracking.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Must Reads Oct. 21, 2014
InformationWeek's new Must Reads is a compendium of our best recent coverage of digital strategy. Learn why you should learn to embrace DevOps, how to avoid roadblocks for digital projects, what the five steps to API management are, and more.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
A roundup of the top stories and community news at InformationWeek.com.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.