‘Adobe Reader is ‘a program for viewing Portable Document Format (PDF) documents. Acrobat is the program used to create such documents’.
‘The information has been provided by iDefense Labs.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=656‘
* Adobe Reader version 8.1 on Windows XP SP2
* Adobe Reader version 8.1.2
Exploitation of this vulnerability would allow an attacker to execute arbitrary code as the current user. In order to exploit this vulnerability, an attacker would have to convince the targeted user to open a maliciously constructed file. This file could be sent directly to the targeted user or linked from a website.
Insufficient error checking is performed on the input which allows, among other things, attacker-supplied data to be written to arbitrary offsets in memory, potentially resulting in arbitrary code execution.
Adobe released version 8.1.2 of Adobe Reader and Acrobat to address this vulnerability. Although there is currently no update for version 7.0.9, Adobe reports it does plan to release one at a later date. For more information, visit the vendor’s advisory at the following URL: http://www.adobe.com/support/security/advisories/apsa08-01.html
10/03/2007 – Initial vendor notification
10/03/2007 – Initial vendor response
10/26/2007 – Request for status
10/26/2007 – Status – Est. early January
01/04/2008 – Request for status
01/04/2008 – Status – Scheduled early February
01/28/2008 – Adobe plans patch for 8, but not 7
01/30/2008 – Concerns about the plan e-mailed to Adobe
01/31/2008 – Telephone call to clarify concerns
02/06/2008 – Adobe releases 8.1.2
02/07/2008 – Adobe publishes APSA08-01
02/08/2008 – Public disclosure’