WARNING: new Adobe zero-day vulnerability in the wild

happygeek 0 394 Views

Still using Adobe Acrobat or Adobe Reader? Maybe it is time to switch to something that's not glowing red on the bad guy radar, or which is more securely coded depending upon how you look at these things. Yes, Adobe has admitted that there is yet another possible zero-day vulnerability in Adobe Acrobat and Reader, oh deep joy.

David Lenoe of Adobe confirms "...Adobe received reports of a vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions being exploited in the wild" adding that the company is "currently investigating this issue and assessing the risk to our customers" and "will provide an update as soon as we have more information".

According to Symantec which discovered the vulnerability "the PDF files we discovered arrives as an email attachment. The attack attempts to lure email recipients into opening the attachment. When the file is opened, a malicious file is dropped and run on a fully patched system with either Adobe Reader or Acrobat installed. Symantec products detect the file as Trojan.Pidief.H".

I've said it before and I will say it again: "I just don't get is how month after month, quarter after quarter, year after year, the vulnerabilities just keep piling up". And piling up they are, with reports
seemingly coming thick and fast over the last couple of years.

Dani AI

Generated

called this one out correctly — for the record this December 2009 PDF exploit is tracked as CVE‑2009‑4324, a use‑after‑free in the Doc.media.newPlayer code path that was observed being exploited in the wild. The vulnerability allowed a crafted PDF to trigger memory corruption and execute code with the victim user's privileges. (nvd.nist.gov)

Adobe published Security Advisory APSA09‑07 on December 15, 2009 and scheduled a product update to resolve the issue (planned for January 12, 2010). Until the patch was available Adobe recommended either applying their JavaScript Blacklist Framework or disabling Acrobat/Reader JavaScript entirely (Edit → Preferences → JavaScript → uncheck “Enable Acrobat JavaScript”). Adobe also noted Data Execution Prevention (DEP) reduced impact on some Windows configurations. (adobe.com)

Practical, immediate actions (useful for readers who find this thread much later):

  • If possible, update Reader/Acrobat to a vendor‑patched version or uninstall Reader and use a modern, sandboxed PDF viewer (browser built‑in viewers or PDF.js).
  • Disable Acrobat JavaScript and turn off PDF preview in mail clients.
  • Treat unexpected PDF attachments as hostile: do not open, scan with AV/VirusTotal, or open only inside an isolated VM/sandbox.
  • For incident hunting, samples from this campaign included a dropped executable named AdobeUpdate.exe that fetched ab.exe (saved as winver32.exe) and network indicators such as foruminspace[.]com — check logs and endpoints for those IOCs. (isc.sans.edu)

Longer term: track the CVE in your vulnerability management system (this CVE was later added to CISA’s Known Exploited Vulnerabilities listings), apply vendor updates promptly, and reduce PDF attack surface (disable unnecessary scripting, avoid browser plugins that hand off PDFs to external processes). For legacy environments that cannot be patched immediately, strict email filtering, gateway scanning and sandboxing are essential. (nvd.nist.gov)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview