Adobe promises patch for zero-day PDF bug by next Tuesday
That's also Microsoft's monthly patch day for May
Computerworld - Adobe has promised to patch the newest zero-day vulnerability in its popular Adobe Reader software no later than next Tuesday, potentially adding another update to the month's busiest patch day for the second time in three months.
May 12 is also Microsoft's regularly-scheduled monthly Patch Tuesday.
On Friday, Adobe's security team announced that it would issue updates to Adobe Reader and Acrobat -- versions 9.x, 8.x and 7.x for Windows, 9.x and 8.x for Mac and Linux -- by next Tuesday.
"Additionally, we have confirmed the second vulnerability (CVE-2009-1493) for Adobe Reader for Unix," he added, referencing a second bug that was reported last week. "This issue will be resolved in the upcoming Adobe Reader for Unix updates. Currently, we have not been able to reproduce an exploitable scenario for Windows and Macintosh, but we will continue to investigate."
Adobe didn't complete its patching until March 24, when it delivered updates for Linux and Solaris, putting the bug's window of vulnerability at between 19 and 33 days. By comparison, if Adobe patches next Tuesday, the window for the newest flaw would be only 14 days.
We're continuing our work to be able to respond as diligently as possible when issues arise," Brad Arkin, Adobe's director of product security and privacy, said in an e-mail. "The timing of our planned product updates is based on this commitment."
"Their timing is the silver cloud," agreed Andrew Storms, director of security operations at nCircle Network Security Inc. "But it's difficult to see through that cloud."
Storms, who has been critical of Adobe's security process, remained so today. Not only has Adobe set the Reader patch for the same day that Microsoft will roll out it own fixes, but the paucity of information and the lack of security management tools from Adobe continues to frustrate Storms.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts