Adobe doles out bug-filled PDF Reader to users
It still offers Reader 9.1 for download; users at risk without critical updates, says Secunia
Computerworld - Adobe delivers an out-of-date version of Reader to users who download the popular application from its Web site, a security company warned today.
The edition Adobe currently offers includes at least 14 security vulnerabilities that have been patched by the company in the last two months.
Danish vulnerability tracking vendor Secunia first noticed that Adobe was offering an outdated Reader when users of its Personal Software Inspector (PSI) utility -- which scans Windows PCs for unpatched applications -- started complaining when the tool said they were running a vulnerable version, even though they had just downloaded the PDF viewer.
"There was some confusion about Adobe Reader," said Mikkel Winther, the manager of the PSI partner program. "Users had downloaded the latest Reader, but still PSI was telling them that it was vulnerable."
At first, Secunia suspected that PSI was throwing off a "false positive," but that wasn't the case. "Adobe.com ships software with known vulnerabilities," Winther said.
The version now hosted on Adobe's Web site, said Winther, is Reader 9.1, an edition that was released March 10 to plug several holes, including one that had been actively exploited by hackers since at least Jan. 9, 2009.
Adobe has issued two security updates since then. The first, released May 12, patched another "zero-day" bug in Reader, while the second, issued June 9, fixed at least 13 critical flaws reported by outside researchers and secretly patched an unspecified number of bugs found by Adobe's own security team.
Computerworld confirmed that Adobe's Web site offers Reader 9.1 to users who download the application.
According to Adobe, that's normal practice. "Adobe Reader 9.1 for Windows is the most recent full installer of the product," said a company spokesman. "Adobe Reader 9.1.1 and 9.1.2 for Windows are patches that require Adobe Reader 9.1 to be present. This is the reason users are offered Adobe Reader 9.1 via the 'Get Adobe Reader' page on Adobe.com."
"Adobe does have the Adobe Updater, which will eventually update Reader to the patched versions," said Winther, "but sometimes it takes days or weeks for the updater to come up." By default Adobe's updater pings the company server once a week.
Adobe's practice leaves users vulnerable to hackers who rely on malformed PDF documents to hijack PCs, said Winther. If a user receives a PDF -- likely as an attachment to an e-mail message -- but doesn't have Reader installed, then downloads and installs Reader 9.1 from the company's site, he can be successfully attacked by exploits fixed in Version 9.1.1 and 9.1.2.
"PC users need to patch all their vulnerable programs and they need to do so as fast as possible after the patch has been issued from the vendor," said Winther. "Failing to do so is playing Russian Roulette.... It is only a question of time, and luck, when your system will be compromised."
Winther urged users who have recently downloaded and installed Reader to manually update the application by selecting "Check for Updates" from the "Help" menu. Alternately, they can download and run Secunia's PSI tool to locate any outdated software.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts