A recently discovered zero-day vulnerability affecting Adobe Reader and Acrobat with malicious PDF files is reportedly attracting a swarm of hackers eager to exploit it. Adobe officials say a fix for the issue will be available for Adobe Reader and Adobe Acrobat in the coming weeks.Hackers have once again turned to PDF files to spread their wares,
this time assaulting a zero-day flaw affecting Adobe Reader and Acrobat.
Fortunately, the unpatched bug is
on the company’s radar, and fixes for Adobe Reader 9 and Acrobat
9 are slated to be available March 11. Updates for earlier
versions will come later, company officials said in an advisory.
The bug is due to an error in the parsing of certain structures in PDF files. If exploited successfully, the bug could allow a hacker to take complete control of a vulnerable system.
“In parsing a specially-crafted embedded object, a bug in the reader
allowed the attacker to overwrite memory at an arbitrary location,”
blogged McAfee researcher Geok Meng Ong. “The attacks, found in the
field, use the infamous heap spray method via JavaScript to achieve
control of code execution.”
“While the distribution of this exploit thus far appears to be
targeted, new variants are expected as more information is made
public,” the researcher continued. “As with the Conficker experience,
the lack of good patch management is a very worrying trend that
deserves more attention from IT security practitioners. Adobe is
expected to release a patch very soon.”
Read the rest of this article on eWEEK.com.
Online Media 
