Web attacks target PDF flaw

By Shaun Nichols on Feb 12, 2008 7:43 AM
Filed under Security

Security researchers are warning users to upgrade their version of Adobe's Acrobat Reader following reports of new vulnerabilities..

The attacks target a flaw in the way Acrobat handles PDF files within Internet Explorer which could allow an attacker to remotely execute code.

Adobe released a patch for the vulnerability on Wednesday. However, security firm Sans Institute reported on Friday that it had discovered malicious banner ads which exploit the flaw.

The banner ads install Trojan files which delete any competing malware on the user's system.

Sans Institute traced the ads back to a hosting service in The Netherlands, which has since been notified and has removed the malicious files.

Greg McManus, a researcher with iDefense Labs, was credited with discovering the flaw, which was disclosed to Adobe in October last year.

IDefense reported that the malicious PDF files being used in the attack are currently undetectable by most antivirus programs. The company has provided a number of vendors with samples.

Users are urged to upgrade Adobe Acrobat Reader to version 8.1.2, which patches the vulnerability and prevents the attack being launched.