Adobe Investigating Reports of Acrobat Exploits

Oh yay! Hackers have found a new exploit in Adobe Reader and Acrobat.

The fun just doesn't end for Adobe in its fight to keep hackers out of Reader and Acrobat. The company announced on Monday (via its PSIRT) that new reports have surfaced in regards to a previously unknown vulnerability in Adobe Reader and Acrobat. Adobe said that both the latest and older versions are being exploited "in the wild," meaning that the problem didn't just appear in the the recent v9.2.

While Adobe did not provide details on the 0-Day exploit, malware-tracking group Shadowserver Foundation said that the exploit has been in the wild since December 11, and that the attacks are limited and targeted by nature. The group did not release the exploit details, but rather only indicated that the problem was linked to a JavaScript function in Acrobat/Reader.

"This is legit and is very bad," the group said. "The vulnerable JavaScript is obfuscated inside a zlib stream making universal detection and intrusion detection signatures much more difficult."

The quick fix--until Adobe addresses the problem--is to disable JavaScript in Acrobat and Reader. To do this, simply click on Edit and choose Preferences. Click JavaScript on the left-hand menu and make sure to uncheck the Enable Acrobat JavaScript option. Users of Acrobat/Reader 7.x may or may not be affected by the new attack--this version has not been tested as of this writing, but disable JavaScript anyway, just in case.

This sounds like a job for Mermaid Man!