Adobe Reader update patches bugs, removes bundled Flash Player
Four critical vulnerabilities were addressed and several security changes were made in Adobe Reader 10.1.3 and 9.5.1
IDG News Service - Adobe Systems released new versions of Adobe Reader 10.x and 9.x on Tuesday, addressing four arbitrary code execution vulnerabilities and making several security-related changes to the product, including the removal of the bundled Flash Player component from the 9.x branch.
All of the vulnerabilities fixed in the newly released Adobe Reader 10.1.3 and Adobe Reader 9.5.1 versions could be exploited by an attacker to crash the application and potentially take control of the affected system, Adobe said in its APSB12-08 security bulletin. Users are advised to install these updates as soon as possible.
The company also announced that Adobe Reader 9.5.1 no longer includes authplay.dll, a Flash Player library that was bundled with previous versions of the program to enable the rendering of Flash content embedded in PDF documents.
The presence of the authplay.dll component in Adobe Reader has caused some security issues in the past, primarily because of the inconsistent update schedules for Adobe Reader and Flash Player.
Authplay.dll contains much of the stand-alone Flash Player's code, which also means that it shares most of the latter's vulnerabilities. However, while Flash Player is patched by Adobe when needed, Adobe Reader used to follow a more strict quarterly update cycle.
This often resulted in situations where some known vulnerabilities got patched in Flash Player, but remained exploitable through authplay.dll for months, until the next scheduled update for Adobe Reader.
Such is the case with the new Adobe Reader 10.1.3 version, which incorporates three previous Flash Player security updates that were released separately during the last three months.
Starting with Adobe Reader 9.5.1, Adobe Reader 9.x will use the stand-alone Flash Player plug-in that's already installed on computers for browsers like Mozilla, Safari or Opera, in order to play Flash content in PDF files.
This functionality will not work with the ActiveX-based Flash Player plug-in for Internet Explorer or the special Flash Player plug-in version bundled with Google Chrome.
Adobe plans to remove authplay.dll from the 10.x branch of Adobe Reader in the future as well and is currently working on APIs (application programming interfaces) to make this possible, said David Lenoe, group manager for Adobe's Product Security Incident Response Team (PSIRT), in a blog post Tuesday.
Vulnerability management vendor Secunia welcomes Adobe's decision to remove authplay.dll from Adobe Reader, because it will make addressing Flash vulnerabilities easier for users, Secunia's chief security specialist, Carsten Eiram, said.
"However, the default option in Adobe Reader should be to not support Flash content in PDF files, requiring users to specifically enable this," Eiram said. "Most users do not need it and Flash content embedded in PDF files has historically been exploited as a vector to compromise Adobe Reader users' systems."
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Acxiom Case Study This case study, which focuses on Acxiom, explores how the company was able to secure employee data, reduce migration costs and boost productivity...
- Windows® XP Migration: Protect and Secure Critical Data With the end of the Microsoft Windows XP operating system's lifecycle on April 8, 2014, businesses are faced with the decision to migrate...
- Enhancing Application Protection and Recovery with a Modern Approach to Snapshot Management This CommVault Business Value and Technology White Paper explains how Simpana IntelliSnap® Recovery Manager can make your application recovery fast and reliable.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts