Cyber Security Alert SA11-350A

[admin]

Cyber Security Alert SA11-350A


Adobe Updates for Multiple Vulnerabilities

Original release date: December 16, 2011
Last revised: --
Source: US-CERT


Systems Affected

* Adobe Reader X (10.1.1) and earlier 10.x versions for Windows and Macintosh
* Adobe Reader 9.4.6 and earlier 9.x versions for Windows, Macintosh, and UNIX
* Adobe Acrobat X (10.1.1) and earlier 10.x versions for Windows and Macintosh
* Adobe Acrobat 9.4.6 and earlier 9.x versions for Windows and Macintosh


Overview

Adobe has released Security Bulletin APSB11-30, which describes
multiple vulnerabilities affecting Adobe Reader and Acrobat.


Solution

Update Reader

Adobe has released updates to address this issue. Users are
encouraged to read Adobe Security Bulletin APSB11-30 and update
vulnerable versions of Adobe Reader and Acrobat.

Do not access PDF files from untrusted sources

Do not open unfamiliar or unexpected PDF files, particularly those
hosted on websites or delivered as email attachments. Please see
Cyber Security Tip ST04-010.


Description

Adobe Security Bulletin APSB11-30 and Adobe Security Advisory
APSA11-04 describe a number of vulnerabilities affecting Adobe
Reader and Acrobat. These vulnerabilities affect Reader and Acrobat
9.4.6 and earlier 9.x versions. These vulnerabilities also affect
Reader X and Acrobat X 10.1.1 and earlier 10.x versions.

An attacker could exploit these vulnerabilities by convincing a
user to open a specially crafted PDF file. The Adobe Reader browser
plug-in, which can automatically open PDF documents hosted on a
website, is available for multiple web browsers and operating
systems.

Adobe Reader X and Adobe Acrobat X will be patched in the next
quarterly update scheduled for January 10, 2012.

Additional details for the U3D memory corruption vulnerability can
be found in US-CERT Vulnerability Note VU#759307.


References

* Security update available for Adobe Reader and Acrobat -
<https://www.adobe.com/support/security/bulletins/apsb11-30.html>

* Adobe Acrobat and Reader U3D memory corruption vulnerability -
<http://www.kb.cert.org/vuls/id/759307>

* Security Advisory for Adobe Reader and Acrobat -
<https://www.adobe.com/support/security/advisories/apsa11-04.html>