Originally published January 4, 2007 at 12:00 AM | Page modified January 4, 2007 at 1:01 PM
Adobe Reader flaw seen as major PC security problem
Computer security researchers said Wednesday they have discovered a vulnerability in Adobe Systems Inc.'s ubiquitous Acrobat Reader software that allows cyber-intruders to attack personal computers through trusted Web links.
The Associated Press
SAN FRANCISCO (AP) — Computer security researchers said Wednesday they have discovered a vulnerability in Adobe Systems Inc.'s ubiquitous Acrobat Reader software that allows cyber-intruders to attack personal computers through trusted Web links.
Virtually any Web site hosting Portable Document Format, or PDF, files are vulnerable to attack, according to researchers from Symantec Corp. and VeriSign Inc.'s iDefense Intelligence.
The attacks could range from stealing cookies that track a user's Web browsing history to the creation of harmful worms, the researchers said.
The flaw, first revealed at a hacker conference in Germany over the holidays, exists in a plug-in that enables Acrobat users to view PDF files within Web browsers.
By manipulating the Web links to those documents, hackers and online thieves are able to commandeer the Acrobat software and run malicious code when users attempt to open the files, according to Ken Dunham, director of the rapid response team at VeriSign's iDefense Intelligence.
Dunham gave this hypothetical scenario: an attacker finds a PDF file on a banking Web site. The attacker creates a hostile Web site that links to the bank's PDF file. Included is malicious JavaScript code that will run on the unsuspecting user's computer once the link is clicked.
"PDF is trusted and tried and true — everyone uses it," Dunham said. "But instead of just viewing the file, you've initiated script that shouldn't be executed. All you have to do is click on the PDF and the ball starts rolling."
Representatives from Adobe did not return a call from The Associated Press on Wednesday night.
The flaw appears to target Microsoft Corp.'s Internet Explorer 6.0 Web browser and earlier versions, and Mozilla's Firefox browser, the researchers said.
They recommended that users protect themselves by upgrading Internet Explorer or changing Firefox's user options so the browser does not use the Acrobat plug-in.
Researchers said it's unclear how pervasive or harmful any future attacks might be.
"Given that it is easy to exploit, I would expect that we will see this method used considerably in the coming days and weeks, until it is resolved," a Symantec researcher said in a posting on a company Web log.
Copyright © 2007 The Seattle Times Company
Nintendo re-enlists Mario, savior of video-game industry
Verizon-Frontier deal stirs concern among consumers
Brier Dudley: 'Guitar Hero' founder excited about future
Gaps for consumers in Democrat health care bills
Hutch gets $10M from Bezos family for immunotherapy research

Real Salt Lake wins MLS Cup
Real Salt Lake defeated the Los Angeles Galaxy with penalty kicks after 120 minutes of play at Qwest Field in Seattle.
nwjobs

Post a comment

Michelle Goodman blogs about work/life balance.
How to tell your office you're gravely ill
Post a comment
nwautos

Choosing a new sedan? Weigh the impact of your choice on your wallet and on the planet.
Post a comment
- 'The Road' takes Viggo Mortensen to Mount St. Helens and Astoria, Ore.
- Tugboat sinks at Seattle waterfront pier
- Child-support error costs nearly $21,000
- Craigslist adoption ad: A plea by young mother-to-be? A scam?
- Chase shrugs off loss of CD investors
- Vikings easily beat the Seahawks
- Denny Triangle gains skyline, but tenants slow to come
- Snow piles up on Cascade slopes
- Woman stabbed by stranger in North Seattle
- Illegal workers quietly let go
- Senate vote clears hurdle
239 - Vikings easily beat the Seahawks
137 - Child-support error costs nearly $21,000
129 - Palin excitement builds in Tri-Cities
124 - Tight Senate vote launches health care over hurdle
123 - Cutting through breast-cancer confusion
91 - Historic health care bill clears Senate hurdle
90 - Game thread
70 - New York terror trials will restore faith in rule of law
66 - Chase shrugs off loss of CD investors
54
- 'The Road' takes Viggo Mortensen to Mount St. Helens and Astoria, Ore.
- Child-support error costs nearly $21,000
- It's possible to recover a life lost to hoarding
- Washington state wines make annual best-of list
- Sprouts, raw fish on attorney's 'do not eat' list
- Banff: powder, peaks & purity
- Chase shrugs off loss of CD investors
- Rediscovering Moab, 'the most beautiful place on Earth'
- Denny Triangle gains skyline, but tenants slow to come
- Protect yourself from baggage loss





