
URGENT
February 23, 2009 - v1.1
Adobe released a security bulletin about a vulnerability in Acrobat products where a specially crafted PDF document can be used to gain control of the machine used to view the document. This would allow the attacked machine to be used to install malicious software if the user's security setting allow for it. Adobe reports that they are working on a solution and with anti-virus vendors to develop a detection for the malformed PDF files, but Adobe does not expect to have a fix until March 11, 2009. Some reports are inaccurately stating that this only affects Windows XP users - the flaw exists in Acrobat Reader itself, and more accurately, in the processes that render JavaScript to your screen - usually through web browser screens. This means that all platforms (Windows XP, Windows Vista, Windows Server, MAC, Linux, etc) are all vulnerable.
We recommend that until your system is updated, do not open PDF documents received unexpectedly or without a confirmed source by email, do not open links to PDF documents on websites, and consider disabling the JavaScript interface in Acrobat Reader and enabling Data Execution Protection on Windows systems.
These three recommendations all come with a cost. Adobe PDF documents and the software for viewing them have become part of most businesses workflow. If your business application created the PDF within your network as part of a reporting process - then the file should be considered safe. If someone emails you a PDF or a link to a website with information in a PDF - you should be extremely cautious at this point. Once Adobe releases the updates, you should get your Acrobat products patched immediately.
Please use safe web browsing and email practices. Your servers should never be used for web-browsing except for updates from trusted web sites (such as Microsoft). Your users should be logged into their desktop or remote sessions as non-administrator level users. Systems administrators should have separate administrator-level accounts to help limit risks during their daily activities.
Links to Adobe:
Adobe Annoucement on Buffer Overflow Flaw
Links to Security Software Sites:
Sophos
McAfee
Symantec
Links to news reports:
CNet News
Shadow Server
MacWorld