Adobe admits users vulnerable after downloading Reader
Confirms updater doesn't always work, says it's reevaluating patch install process
Computerworld - Adobe has acknowledged that some users are vulnerable to attack after downloading an outdated version of Reader from its Web site, and said it is now reevaluating how it updates the popular PDF reader.
Yesterday, Brad Arkin, Adobe's director for product security and privacy, responded to claims by Danish security vendor Secunia that the currently-available version of Reader contains numerous bugs, and that Adobe's update process can leave users vulnerable for days or even weeks.
"We do single-dot releases, such as [Reader] 9.1, as full installers," explained Arkin, referring to the version Adobe released in mid-March to plug several holes, including one that had been exploited by hackers since early January. "The double-dot releases, like 9.1.1 and 9.1.2, those are for patches only and work only with a full-installed version in place."
The single-dot releases, such as Reader 9.1, must meet a different quality level for testing than the patch releases. Doing it that way will "get security fixes faster to users," Arkin said. "That helps keep users up-to-date."
Patch-only updates are common in software, but the problem with Adobe's practice is that it continues to provide an out-of-date edition that many times isn't updated with the latest patches, argued Secunia on Monday. Adobe has issued two security updates since Reader 9.1's debut. The first, released May 12, patched a "zero-day" bug in Reader, while the second, issued June 9, fixed 13 or more flaws.
"Adobe does have the Adobe Updater, which will eventually update Reader to the patched versions," said Mikkel Winther, the manager of Secunia's PSI partner program yesterday. "But sometimes it takes days or weeks for the updater to come up."
By default Adobe's updater pings the company server once a week.
Adobe's Arkin admitted that the updater doesn't always work as it's supposed to. "The intended behavior of the updater is that when you launch Reader for the first time, it will check if there are any updates available," he said. "That's its intended behavior, but there are a lot of [PC] configuration factors that might lead to different behavior."
Arkin confirmed that a first-launch of Reader sometimes fails to trigger Adobe's updater on PCs in its own labs. The updater failed to appear after launching Reader 9.1 for the first time on three different Windows PCs that Computerworld tested.
Abode is also reevaluating how frequently its software updater pings the company's servers to see whether a patch is ready for download. Currently, the updater defaults to weekly intervals, with monthly intervals the only other option. "We decided that's the right amount of time after feedback from enterprises," said Arkin. He declined to specify what changes Adobe is considering for the updater, and whether those may involve more interval choices for users or a shorter interval, perhaps a daily check for updates, that would be set by default.
"Security patching is also part of the overall security process," Arkin said.
Two months ago, Adobe announced it had seen the security light, and promised it would root out bugs in older code, speed up the patching process and release regular security updates for Reader. The first quarterly update was issued last month.
Hackers continue to hammer Reader. According to New York-based CA today, there are "a vast number of malicious PDF files in circulation on the Internet," many of them pitching multiple exploits at Windows users.
Read more about Security in Computerworld's Security Topic Center.
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts