Attackers gun for Adobe flaw

Users are being advised to update their systems after the emergence of a new rash of attacks targeting a previously-patched flaw in Adobe Acrobat.

Users are being advised to update their systems after the emergence of a new rash of attacks targeting a previously-patched flaw in Adobe Acrobat.

The attacks use specially-crafted PDF files to exploit a vulnerability in the Java component of Adobe Acrobat Reader to perform malware installations on targeted systems.

Users can protect against the attacks by updating Adobe Acrobat and Reader to the latest versions. Users running version 9 of either product are not vulnerable to the attack.

The attacks are part of an ongoing effort by malware authors to exploit the vulnerability which was among several patched by Adobe last week.

Although a fix for the vulnerability is available, the attack remains highly active and hard to spot, according to experts.

Sans Institute researcher Swa Frantzen said in a security alert that the malicious package is still very hard for many anti-malware products to identify, and is being updated to evade detection.

Users and administrators who are unsure whether all of their systems are patched should update user policies to prevent downloaded JavaScript from running within PDF files.