Public exploit code just 'day or two' away, says Metasploit's HD Moore
The advice is timely, as noted bug researcher and exploit maker HD Moore confirmed that an exploit would be published to the open-source Metasploit penetration testing framework within a day or two.
But if Moore's preliminary work is any indication, attack code will go public long before then. "It is a little tricky to make reliable, but we are on track and should have a Metasploit update ready within a day or two at the latest," Moore said, referring to the probable release of an exploit module for the testing framework. Moore obtained a sample of the malicious PDF document being used to exploit the bug only this morning.
Moore also defended Metasploit's practice of providing working exploit code to anyone, including hackers. "Since the bug is 1) public and 2) widely exploited, we feel that adding an exploit module is the right thing to do, as it provides a safe way for folks to verify that their mitigation efforts actually work," said Moore.
Adobe will release its own in-lieu-of-patch recommendations later today, said Brad Arkin, Adobe's director for product security and privacy, in a direct tweet to Computerworld. "Full advisory coming later today with mitigation details," Arkin said around 3 p.m. Eastern. "Team is pulling that info together now."
Earlier today, Arkin told IDG News Service reporter Bob McMillan that the exploit targeted Windows users only. "It may trigger a crash on other platforms, but not an exploit," Arkin said in a direct tweet to McMillan.
Adobe Reader and Acrobat run on Windows, Mac OS X and Linux.
Read more about Security in Computerworld's Security Topic Center.
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!