Risk: High
Adobe Systems Inc. has warned of two serious security flaws affecting Windows, Mac OS X and Unix versions of its Acrobat software. The bugs could allow an attacker to execute malicious code on a user's system via a PDF file distributed via email, according to security researchers.
The first flaw affects Version 6.0.2 of Acrobat Reader, according to an advisory posted to the Bugtraq mailing list by security research firm iDefense, which discovered both bugs. Reader incorrectly parses the .etd files used in eBook transactions so that an .etd file containing special code in the "title" or "baseurl" fields can cause an invalid memory access.
This could allow the execution of malicious code with the privileges of the user. An attacker could exploit this bug by sending an email message including either an attached PDF file or a link to the file.
Earlier versions of Acrobat Reader 6 may also be vulnerable, and Adobe Acrobat may also be affected, iDefense said. Adobe has released Version 6.0.3 of both Acrobat and Reader for the Windows and Mac OS X platforms, which fixes the problem.
iDefense said users can also protect themselves by deleting the file: "C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\eBook.api." This doesn't affect the handling of PDF files, but won't allow Acrobat or Reader to handle eBooks.
A separate flaw has a similar effect on Reader Version 5.0.9 for Unix, iDefense said. This flaw is found in Reader's email function, mailListIsPdf, and can be exploited in the same way as the eBook bug. Adobe made it clear it isn't aware of any attempts to exploit the flaw, but recommended that users update to the newly released Acrobat Reader 5.0.10 "as a precaution."
iDefense added that previous versions of Reader 5 for Unix are probably vulnerable. The company said Unix users can get additional protection from an unofficial patch for the acroread shell script, which adds a check ensuring that files passed to acroread are in fact PDF documents. The patch doesn't protect against files opened manually from within Reader, iDefense said.
Secunia, an independent security researcher that maintains a vulnerabilities database, gave the Unix flaw a "highly critical" rating. Both bugs were discovered in mid-October 2004, but were only recently made public so as to allow Adobe time to analyse and correct the problem.