Adobe investigating DoS 'issue' in Reader

Adobe is investigating a "potential issue" in Reader that could permit the launch of denial-of-service attacks against affected computers, the company said.

The vulnerability, complete with proof-of-concept code, was first revealed on the Full Disclosure mailing list. The proof exploit did not demonstrate remote code execution, but it may be possible, David Lenoe said in an Adobe Product Security Incident Response Team blog post.

Security firm VUPEN has, in fact, confirmed that the flaw can be remotely exploited to execute malicious code, according to an advisory.

While Adobe investigates, users of Reader 9.2 or later versions or 8.1.7 and later versions are encouraged to use the JavaScript Blacklist Framework, a mechanism to block vulnerable JavaScript APIs that eliminates the need to block all of JavaScript. The blog post details specific instructions.

Adobe, which stopped short of calling the latest issue a 'vulnerability', did not say when it might have more information.

It is expected to update Reader and Acrobat sometime during the week of November 15 for a zero-day vulnerability that is being actively exploited.

See original article on scmagazineus.com