Adobe Systems Inc. issued an emergency update to its Acrobat and Reader applications, repairing two critical vulnerabilities that could be used by attackers to crash the program and take control of an affected system.
In a security bulletin
Adobe addressed an issue with Flash Player that enables an attacker to bypass process sandboxing within Reader and Acrobat to make anonymous requests to third-party websites. Adobe said the flaw is critical. The flaw enables an attacker to redirect components within embedded flash in PDF files to malicious webpages, either causing the Flash Player to display unauthorized material or trick the victim into downloading malware.
A second critical vulnerability causes the application to crash and could enable an attacker to execute code remotely and install malware, taking over a victim's machine. No details on the vulnerability are currently available. It was credited to the Microsoft Vulnerability Research Program (MSVR). MSVR is Microsoft's responsible disclosure program for reporting vulnerabilities that its engineers discover in third-party applications running on Windows.
Danish vulnerability clearinghouse Secunia gave the update a highly critical rating.
Adobe issued a critical update to its Flash Player last week, repairing the same sandboxing bypass vulnerability in Flash Player versions 10.0.42.34 and earlier, as well as Adobe AIR versions 126.96.36.19920 and earlier.
- Robert Westervelt