Adobe admits users vulnerable after downloading Reader
Confirms updater doesn't always work, says it's reevaluating patch install process
Computerworld - Adobe has acknowledged that some users are vulnerable to attack after downloading an outdated version of Reader from its Web site, and said it is now reevaluating how it updates the popular PDF reader.
Yesterday, Brad Arkin, Adobe's director for product security and privacy, responded to claims by Danish security vendor Secunia that the currently-available version of Reader contains numerous bugs, and that Adobe's update process can leave users vulnerable for days or even weeks.
"We do single-dot releases, such as [Reader] 9.1, as full installers," explained Arkin, referring to the version Adobe released in mid-March to plug several holes, including one that had been exploited by hackers since early January. "The double-dot releases, like 9.1.1 and 9.1.2, those are for patches only and work only with a full-installed version in place."
The single-dot releases, such as Reader 9.1, must meet a different quality level for testing than the patch releases. Doing it that way will "get security fixes faster to users," Arkin said. "That helps keep users up-to-date."
Patch-only updates are common in software, but the problem with Adobe's practice is that it continues to provide an out-of-date edition that many times isn't updated with the latest patches, argued Secunia on Monday. Adobe has issued two security updates since Reader 9.1's debut. The first, released May 12, patched a "zero-day" bug in Reader, while the second, issued June 9, fixed 13 or more flaws.
"Adobe does have the Adobe Updater, which will eventually update Reader to the patched versions," said Mikkel Winther, the manager of Secunia's PSI partner program yesterday. "But sometimes it takes days or weeks for the updater to come up."
By default Adobe's updater pings the company server once a week.
Adobe's Arkin admitted that the updater doesn't always work as it's supposed to. "The intended behavior of the updater is that when you launch Reader for the first time, it will check if there are any updates available," he said. "That's its intended behavior, but there are a lot of [PC] configuration factors that might lead to different behavior."
Arkin confirmed that a first-launch of Reader sometimes fails to trigger Adobe's updater on PCs in its own labs. The updater failed to appear after launching Reader 9.1 for the first time on three different Windows PCs that Computerworld tested.
Abode is also reevaluating how frequently its software updater pings the company's servers to see whether a patch is ready for download. Currently, the updater defaults to weekly intervals, with monthly intervals the only other option. "We decided that's the right amount of time after feedback from enterprises," said Arkin. He declined to specify what changes Adobe is considering for the updater, and whether those may involve more interval choices for users or a shorter interval, perhaps a daily check for updates, that would be set by default.
"Security patching is also part of the overall security process," Arkin said.
Two months ago, Adobe announced it had seen the security light, and promised it would root out bugs in older code, speed up the patching process and release regular security updates for Reader. The first quarterly update was issued last month.
Hackers continue to hammer Reader. According to New York-based CA today, there are "a vast number of malicious PDF files in circulation on the Internet," many of them pitching multiple exploits at Windows users.
Read more about Security in Computerworld's Security Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Alert Logic for PCI DSS Compliance To achieve PCI DSS compliance, you must identify and remediate all critical vulnerabilities detected during PCI scans. Threat Manager streamlines this process by...
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts