Vulnerability in Acrobat Reader

Question

Vulnerability in Acrobat Reader Oxygen3 24h-365d, by Panda Software (http://www.pandasoftware.com) Madrid, November 30, 2006 -A series of vulnerabilities has been announced in Adobe Reader and the ActiveX Acrobat control that could be exploited by attackers to take complete control of affected systems. These flaws are due to memory corruption errors in the ActiveX AcroPDF control (AcroPDF.dll) as it does not adequately handle badly constructed arguments when passed to the 'src()', 'setPageMode()', 'setLayoutMode()', 'setNamedDest()' and 'LoadFile()' methods. A remote attacker could exploit this problem to execute arbitrary commands if he were able to trick users into visiting a specially crafted web page. Adobe Reader versions 7 to 7.0.8 and Adobe Acrobat (Standard and Professional) versions 7.0.0 to 7.0.8 are affected. As a workaround, Adobe recommends deleting the 'AcroPDF.dll' library, to prevent PDF documents from being opened from Internet Explorer. Adobe offers more information at: http://www.adobe.com/support/security/advisories/apsa06-02.html

zbestwun2001 · Answer

See? Sometimes it pays not be able, for whatever reason, to update Acrobat to the most current version. :) I am stuck at v5 zb1

ky331 · Answer

information from http://www.adobe.com/support/security/bulletins/apsb06-20.html

Adobe Reader 7.0 through 7.0.8 users should upgrade to Reader 8: www.adobe.com/products/acrobat/readstep2.html.

System Requirements (for Windows Version)

Intel® Pentium® III or equivalent processor
Windows XP Professional, Home Edition, or Tablet PC Edition with Service Pack 2; Microsoft® Windows® 2000 with Service Pack 4; Windows 2003 Server; or Windows Vista™*
128MB of RAM (256MB recommended for complex forms or large documents)
110MB of available hard-disk space
Microsoft Internet Explorer 6.0 or 7.0, Firefox 1.5 or 2.0, Mozilla 1.7, AOL 9
Adobe Reader 7.0 through 7.0.8 users who cannot [or for whatever reason, choose not to] upgrade to Reader 8, as well as Adobe Acrobat 7.0 through 7.0.8 users, should follow the directions below to update their installations:
1. Exit Internet Explorer, Adobe Reader, and Adobe Acrobat, if necessary.
2. Browse to :\Program Files\Adobe\Acrobat 7.0\ActiveX.
  Note: If you did not install Acrobat to the default location, browse to the location of your Acrobat 7.0 folder.
3. Select AcroPDF.dll and delete it.
4. Download the AcroPDF.dll file provided here http://www.adobe.com/support/security/bulletins/acropdf.dll
5. Copy the new AcroPDF.dll file in to the ActiveX directory.

Message Edited by ky331 on 12-06-200609:31 AM

Bugbatter · Answer

Adobe Fixes Reader Flaw, Warns Of New Bug In Download Tool http://www.informationweek.com/story/showArticle.jhtml?articleID=196601932&cid=RSSfeed_IWK_Security

Virus & Spyware

Was this post helpful?