If you are one of the world’s many users of Adobe’s Acrobat PDF Reader software then there’s good reason to prick up your ears and listen today, as details emerge of a critical zero-day vulnerability in the software that could allow hackers to run malicious code on computers.
According to a warning from the security response team at Adobe, a serious vulnerability in all currently supported versions of Adobe Reader and Acrobat ((Adobe Reader and Acrobat 9.1, 8.1.4, and 7.1.1 and earlier versions) are affected by the flaw.
The vulnerability, which is not limited to Windows users but also affects Mac and Unix users, means that Adobe users are being advised to disable JavaScript in Adobe Reader and Acrobat until a proper fix is available.
Adobe advises that JavaScript can be disabled by following these instructions:
1. Launch Acrobat or Adobe Reader.
2. Select Edit/Preferences
3. Select the JavaScript Category
4. Uncheck the “˜Enable Acrobat JavaScript’ option
5. Click OK
Of course, this is far from the first time that critical vulnerabilities have been found in Adobe’s software, and there is growing concern that the vendor’s dominant market share of the PDF reader market is proving extremely attractive for hackers hellbent on infecting as many PCs as possible.
As we predicted in the Sophos 2009 Security Threat Report, hackers are increasingly looking at commonly used browser plugins like Adobe Flash and PDF in their attempts to infect innocent computer users.
In the past I’ve suggested that computer users may want to use FoxIt, an alternative to Adobe PDF Reader. However, on reflection, I think that advice wasn’t that great because if everyone switched en masse to the same alternative to Adobe Reader we’d all be in the same pickle again.
A world of everyone using the same software as everyone else is never healthy for security.
Instead, make your own choice of which PDF reader to use. You can find a helpful list of some suggestions at http://pdfreaders.org/
