Sévérité : Milieu

22 octobre 2007

Résumé :

Hier, l'adobe a libéré une mise à jour pour fixer les vulnérabilités critiques de sécurité qui affectent le lecteur 8.1 d'adobe et l'acrobate d'adobe 8.1 (et toutes les versions plus tôt) courant sur Windows XP. By enticing one of your users into opening a specially crafted PDF file, an attacker can exploit the worst of these flaws to gain control of that user’s system. If you use Adobe Reader or Acrobat in your network, you should download, test, and deploy version 8.1.1 as soon as possible.

Exposure:

In a security bulletin released yesterday, Adobe warned of several critical vulnerabilities in Reader 8.1 and Acrobat 8.1 (and all earlier versions) for Windows XP. While their advisory regularly mentions multiple vulnerabilities, they specifically refer to only one issue, which they describe in little detail. Adobe only says that if an attacker can convince a Windows XP user who also has Internet Explorer (IE) 7 into opening a specially crafted PDF file, the attacker can exploit this unspecified flaw to gain control of that user’s computer. Since you can embed PDF files

About three weeks ago, word of an Adobe security flaw began to do the rounds.  It has taken Adobe three weeks to finally get around to announcing the problem.  The vulnerability allows a hacker to take control of a Windows XP system if it has IE7 installed.  Considering the amount of people that run IE7, it is probably quite a lot of systems.

The vulnerability exists in Adobe Reader 8.1 (and previous versions) Acrobat Standard, Professional and Elements 8.1 (and previous versions) and Acrobat 3D.  It is the reader vulnerability that makes this a particularly serious threat as the number of people using Acrobat is somewhat limited.  What machine doesn’t have a copy of Adobe Reader installed? It is free and PDF is the format of choice for a lot of written material online.

Adobe has released a temporary solution.  It involves making modifications to the Windows Registry, which tends to frighten away all but the power users.  The good news is that a real fix is on the way and should be here before the end of October.  Expect to