June 30, 2010, 2:42 PM — Adobe on Tuesday patched 17 critical vulnerabilities in Reader and Acrobat, including one that hackers have been using for nearly a month to commandeer PCs.
Another patch fixed a design flaw in the PDF format that attackers have been exploiting since April to dupe users into downloading a Trojan horse.
Adobe rushed the security update, which was originally slated to ship July 13, because exploit code went public and attacks using rigged PDF documents started showing on antivirus vendors' reporting systems four weeks ago. The company patched Flash -- hackers were tricking people into visiting malicious sites, then using the same bug to launch drive-by attacks -- on June 10.
Sixteen of the 17 fixed flaws were labeled with the phrase "could lead to code execution" in Adobe's advisory , the company's way of saying that the bug was critical and could be used to hijack machines. Like Apple , and unlike Microsoft , Adobe doesn't rate the severity of the vulnerabilities it patches. The seventeenth patch was also likely critical: "Arbitrary code execution has not been demonstrated, but may be possible," the advisory read.
Another fix addressed a design problem in the PDF document format that could be leveraged to con users into downloading malware. The bug, which was not strictly a security vulnerability, was first disclosed by Belgium researcher Didier Stevens in late March. Stevens demonstrated how a multi-stage attack using the PDF specification's "/Launch" function could successfully exploit a fully-patched copy of Adobe Reader. Stevens also showed how a Reader warning could be changed to further fool users.
Hackers have been using Stevens' technique in mass attacks to infect Windows PCs with bot Trojans.