Adobe Mitigation Plan for Zero Day

Friday, February 15, 2013 @ 04:02 PM gHale


While no patch is ready yet, Adobe has a mitigation approach for the new Adobe Reader and Acrobat Zero Day vulnerabilities undergoing exploitation.

The vulnerabilities (CVE-2013-0640, CVE-2013-0641) are present in Adobe Reader and Acrobat 11.0.01, 10.1.5, 9.5.3 and all their earlier versions for Windows and Macintosh, and allow attackers to compromise the systems of users tricked into opening a malicious PDF file delivered via email, according to security provider FireEye.

RELATED STORIES
Adobe Patches Two Zero Days
Trojan a Work of ‘Poetry’
Ransomware Encrypts Data
Ransomware Uses Java Zero Day

Until Adobe issues a fix, users of Reader and Acrobat 11 should enable the Protected View option (File > Edit > Preferences > Security (Enhanced) > choose the “Files from potentially unsafe locations” or “All files” options). Enterprise administrators can do the same for all Windows users across their organization by enabling Protected View in the registry and propagating that setting via GPO or any other method.

When enabled, the Protected View option makes all PDF documents open in a sandbox.

FireEye researchers released more details about their analysis of the found malicious PDF and said it contains highly obfuscated JavaScript that can check which version of Reader and Acrobat the user is using and creates customized attack code for each of the versions found.

The code is also able to bypass the ASLR and DEP protection, and employs anti-analysis tricks that may allow it to “muddy up” sandbox analysis reports.



Leave a Reply

You must be logged in to post a comment.