Symantec: Zero-day PDF exploit confirmed

Symantec has confirmed that there is indeed a zero-day “Xmas exploit” that target both Adobe Acrobat and Reader.

The zero-day vulnerability is said to be triggered by malicious PDF attachments which unknowingly being opened by recipients.

“The PDF files we discovered arrives as an email attachment. The attack attempts to lure email recipients into opening the attachment. When the file is opened, a malicious file is dropped and run on a fully patched system with either Adobe Reader or Acrobat installed. Symantec products detect the file as Trojan.Pidief.H.,” Symantec said in a blog post.

According to Symantec, they have already informed Adobe of the vulnerability.

Brad Arkin, Adobe’s director of product security and privacy, said the company learned of the attack Monday.

“This afternoon, Adobe received reports of a vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions being exploited in the wild,” Adobe wrote in a post to its Product Security Incident Response Team blog Monday afternoon.

“We are currently investigating this issue and assessing the risk to our customers.”

Symantec, for the meantime, has urged users to be “extra vigilant” this holiday season  especially when opening attachments received from unknown individuals.


Adobe releases patch for Flash hole

Adobe just released a patch for a Flash Player problem that could cause a crash and potentially allow an attacker to take control of the affected system. Updates are available for most Flash installations on WindowsMac and Linux computers.

The critical vulnerabilities were identified to have affected a file that shipped with Flash Player 9.x and 10.x for Windows, MacOS X, and Linux, and with Adobe Reader and Adobe Acrobat 9.x for Windows, Macintosh, and Unix.

In a security advisory released yesterday, Adobe said the problem is now fixed and urges users to patch their installations as the company categorized the problem to be a critical issue.

Matt Rozen from Adobe posted a note on Twitter which gave a link that users can access to download the patched version. You can visit the site here.

An article from the Washington Post website also reminds users that they may need to install the update more than once, depending on the number of browsers your computer has.


Exit mobile version