Sourcefire issues Adobe zero-day patch to block attacks

"Home brew patch," blocks attempts by hackers to exploit an unpatched buffer overflow vulnerability in Adobe Reader 9.

Intrusion detection and prevention vendor Sourcefire Inc. issued a patch for a critical Adobe zero-day vulnerability that is being actively exploited by attackers.

SearchSecurity.com:
To get security news and tips delivered to your inbox, click here to sign up for our free newsletter.

In a Sourcefire Vulnerability Research Team blog posting Sunday, Lurene Grenier, a Sourcefire senior security researcher, wrote the "home brew patch" works for Adobe Reader 9. Those on Adobe 8 need to upgrade to the latest version to apply the patch.

The patch will block a malicious PDF file returning an "Insufficient data for an image," message. Grenier warned that the patch may not prevent all attacks.

Adobe zero-day flaw:
Attackers target new Adobe zero-day flaw:  Attackers are actively targeting a zero-day flaw in Adobe Acrobat Reader software, according to a warning from Symantec.

On Friday, Symantec Corp. researchers warned that hackers were attempting to exploit an Adobe zero-day buffer overflow vulnerability by spreading malicious PDF files containing the Pidief Trojan. Symantec didn't release infection rates, but said that attacks have been extremely limited in scope, targeting a few senior level executives. The first signs of it appearing in the wild were discovered in Japan.

Kevin Haley, director of product management for security response at Symantec, said researchers there were given a sample of the exploit code Feb. 12.

Adobe issued an advisory calling the zero-day flaw critical. The vendor said it plans to release a patch to address the issue by March 11.

"Adobe … recommends that users update their virus definitions and exercise caution when opening files from untrusted sources," the vendor said in its advisory to customers.

In a message to customers Adobe said disabling JavaScript provides protection against currently known attacks. "However, the vulnerability is not in the scripting engine and, therefore, disabling JavaScript does not eliminate all risk." Adobe also listed a number of security and antivirus vendors that protect agains the flaw.


Editor's note: This story was updated to report the latest protection information from Adobe.
This Content Component encountered an error

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close