Adobe warns of PDF threat

Flaws in Adobe Reader and Acrobat could allow an attacker to remotely execute code

Users are being urged to exercise caution when handling PDF files following the discovery of, and subsequent attacks on, a flaw in Adobe software.

The company said in a Security Bulletin that it had received reports of attacks targeting a previously unknown flaw in Adobe Reader and Acrobat. When exploited, the flaw allows an attacker to remotely execute code on a targeted system.

The issue is believed to affect version 9.0 and earlier of both applications. Security firm Shadowserver said in an alert that the vulnerability exists in the way the programs handle JavaScript within PDF files.

The infected files trigger a memory buffer overflow, which in turn allows the attacker to remotely execute code on the targeted system.

"Right now we believe these files are only being used in a smaller set of targeted attacks," wrote Shadowserver researcher Steven Adair. "However, these types of attacks are frequently the most damaging, and it is only a matter of time before this exploit ends up in every exploit pack on the internet."

Adobe said that users should expect to see a fix for the vulnerability by 11 March. In the meantime, researchers at Shadowserver and the US Computer Emergency Response Team recommend users to disable the ability for documents to execute JavaScript code in Acrobat and Reader through the applications' preference panels.