PDF vulnerability lingers despite patch

A workaround for Adobe's PDF blacklist has been found

Adobe is on the defensive following the discovery of a security loophole previously believed to have been patched.

The flaw, which exists in the Reader and Acrobat components, could allow an attacker to remotely execute a malicious application through code embedded in a PDF file by manipulating a warning dialogue.

Adobe had issued a patch to address the vulnerability by instituting a blacklist which could block executable files from being launched. Researchers are reporting, however, that the protections can be circumvented.

Bkis security researcher Le Manh Tung has said that simply adding quotation marks will fool the system and allow an attacker to once again post a misleading warning dialogue.

"With the quotes added, Adobe Reader will not block the execution," wrote Tung in a blog post.

"Adobe Reader version 9.3.3 has fixed the fake warning massage, but the threat of exploit code execution still remains."

Adobe has acknowledged the report and has issued a blog post of its own on the matter. Director of product security and privacy Brad Arkin said that the company is keeping the launch component active, but will look at updating the blacklist to protect against future attacks.

"While blacklist capabilities alone are not a perfect solution to defend against those with malicious intent, this option reduces the risk of attack while minimising the impact on customers relying on workflows that depend on the launch functionality," Arkin wrote.