Adobe patch bypass found

gallery

A workaround for the latest Adobe patch has been discovered by researchers, meaning its Reader product is still vulnerable to attacks.

Didier Stevens, a security researcher from Belgium, was the first to find the flaw in Adobe Reader back in March, which enabled hackers to take over machines and easily run malware.

In his latest blog post, Stevens has claimed the patch released by Adobe last Tuesday, which aimed to fix 17 vulnerabilities overall, still did not fully protect a user from hack attacks.

“I did some research and discovered that Adobe implemented a blacklist of extensions for the launch action, but that the blacklisting functionality identifies the file type of “cmd.exe” as .exe”, and not .exe,” he wrote.

This means by simply including double quote marks around a file name, hackers are still able to get a PDF to run malware.

Stevens has raised the issue – discovered by another researcher, Le Mahn Tung – with Adobe and the company has admitted its blacklisting technique was not ideal.

“While blacklist capabilities alone are not a perfect solution to defend against those with malicious intent… this option reduces the risk of attack, while minimising the impact on customers relying on workflows that depend on the launch functionality,” wrote Brad Arkin on the Adobe Secure Software Engineering Team blog.

“We will evaluate this workaround to determine whether additional changes to the blacklist are required.”

Email to a friend

Print this page