Adobe admits users vulnerable after downloading Reader
Confirms updater doesn't always work, says it's reevaluating patch install process
Computerworld - Adobe has acknowledged that some users are vulnerable to attack after downloading an outdated version of Reader from its Web site, and said it is now reevaluating how it updates the popular PDF reader.
Yesterday, Brad Arkin, Adobe's director for product security and privacy, responded to claims by Danish security vendor Secunia that the currently-available version of Reader contains numerous bugs, and that Adobe's update process can leave users vulnerable for days or even weeks.
"We do single-dot releases, such as [Reader] 9.1, as full installers," explained Arkin, referring to the version Adobe released in mid-March to plug several holes, including one that had been exploited by hackers since early January. "The double-dot releases, like 9.1.1 and 9.1.2, those are for patches only and work only with a full-installed version in place."
The single-dot releases, such as Reader 9.1, must meet a different quality level for testing than the patch releases. Doing it that way will "get security fixes faster to users," Arkin said. "That helps keep users up-to-date."
Patch-only updates are common in software, but the problem with Adobe's practice is that it continues to provide an out-of-date edition that many times isn't updated with the latest patches, argued Secunia on Monday. Adobe has issued two security updates since Reader 9.1's debut. The first, released May 12, patched a "zero-day" bug in Reader, while the second, issued June 9, fixed 13 or more flaws.
"Adobe does have the Adobe Updater, which will eventually update Reader to the patched versions," said Mikkel Winther, the manager of Secunia's PSI partner program yesterday. "But sometimes it takes days or weeks for the updater to come up."
By default Adobe's updater pings the company server once a week.
Adobe's Arkin admitted that the updater doesn't always work as it's supposed to. "The intended behavior of the updater is that when you launch Reader for the first time, it will check if there are any updates available," he said. "That's its intended behavior, but there are a lot of [PC] configuration factors that might lead to different behavior."
Arkin confirmed that a first-launch of Reader sometimes fails to trigger Adobe's updater on PCs in its own labs. The updater failed to appear after launching Reader 9.1 for the first time on three different Windows PCs that Computerworld tested.
Abode is also reevaluating how frequently its software updater pings the company's servers to see whether a patch is ready for download. Currently, the updater defaults to weekly intervals, with monthly intervals the only other option. "We decided that's the right amount of time after feedback from enterprises," said Arkin. He declined to specify what changes Adobe is considering for the updater, and whether those may involve more interval choices for users or a shorter interval, perhaps a daily check for updates, that would be set by default.
"Security patching is also part of the overall security process," Arkin said.
Two months ago, Adobe announced it had seen the security light, and promised it would root out bugs in older code, speed up the patching process and release regular security updates for Reader. The first quarterly update was issued last month.
Hackers continue to hammer Reader. According to New York-based CA today, there are "a vast number of malicious PDF files in circulation on the Internet," many of them pitching multiple exploits at Windows users.
Read more about Security in Computerworld's Security Topic Center.
- PCI 3.0 Compliance In this white paper, learn how PCI-DSS 3.0 effects how you deploy and maintain PCI compliant networks using CradlePoint devices.
- Mitigating Security Risks at the Networks Edge This white paper provides strategies and best practices for distributed enterprises to protect their networks against vulnerabilities, threats, and malicious attacks.
- 5 Strategies for Modern Data Protection Read the five strategies for modern data protection that will not only help solve your current data management challenges but also ensure that...
- 5 Ways Dropbox for Business Keeps Your Data Protected Protecting your data isn't a feature on a checklist, something to be tacked on as an afterthought. Download here to find out how...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!