Adobe has sought to explain to customers the reason for its delaying until mid-January the patch for a newly found critical vulnerability currently being exploited in the wild.An Adobe security advisory said that the flaw, which V3.co.uk first reported on Tuesday, affects Adobe Reader and Acrobat 9.2 and earlier versions, and "could cause a crash and potentially allow an attacker to take control of the affected system".In a blog posting yesterday, Adobe director of product security and privacy Brad Arkin tried to explain why the firm will not release a patch for the flaw until 12 January, even though it has admitted that there are reports of it currently being exploited.He argued that, if the security team worked on an out-of-cycle update, it would take two to three weeks and "negatively impact the timing of the next quarterly security update"."The team determined that, by putting additional resources over the holidays towards the engineering and testing work required to ship a high confidence fix for this issue with low risk of introducing any new problems, they could deliver the fix as part of the quarterly update on January 12 2010," he explained.In the meantime, Adobe is recommending that customers either disable JavaScript in Reader and Acrobat or, for those running versions 9.2 or 8.1.7, to use the JavaScript Blacklist Framework.
Copyright ©v3.co.uk
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @itnews.com.au to your white-listed senders.