PDF vulnerability lingers despite patch

[nsane.forums]

Researchers find social engineering vulnerability still open to attack

Adobe is on the defensive following the discovery of a security loophole previously believed to have been patched by the company.

The flaw, which exists in the Reader and Acrobat components, could allow an attacker to remotely execute a malicious application through code embedded in a PDF file by manipulating a warning dialogue.

Adobe had earlier issued a patch to address the vulnerability by instituting a blacklist which could block executable files from being launched. Researchers are reporting, however, that the protections can be circumvented.

Bkis security researcher Le Manh Tung has reported that by simply adding quotation marks will allow for Adobe's protections to be circumvented and for an attacker to once again post a misleading warning dialogue.

"With the quotes added, Adobe Reader will not block the execution," wrote Tung in a blog post.

"Adobe Reader version 9.3.3 has fixed the fake warning massage, but the threat of exploit code execution still remains."

Adobe has acknowledged the report and has issued a blog posting of its own on the matter. Director of product security and privacy Brad Arkin said that the company was keeping the launch component active, but would also look at updating the blacklist to protect against future attacks.

"While blacklist capabilities alone are not a perfect solution to defend against those with malicious intent, this option reduces the risk of attack, while minimizing the impact on customers relying on workflows that depend on the launch functionality," Arkin wrote.

View: Original Article