IDefense backtracks on PDF scare

By Matt Chapman on Jan 8, 2007 9:39AM

Not as big a problem as first thought.

A serious security flaw thought to affect every website containing a PDF is not as bad as initial warnings claimed, according to the security expert who talked up the danger.

Ken Dunham, director of the Rapid Response Team at VeriSign's iDefense unit, said that the problem is not as bad as first feared because only old browser versions are affected.

"While concern is high due to the widespread use of Adobe products, the impact of this threat is somewhat limited," Dunham told vnunet.com's sister site The Inquirer.

The change of tack followed lab tests by iDefense on various DLL and executable files related to the Adobe Reader vulnerability.

The tests showed that only old versions of Internet Explorer using Adobe Acrobat 6 and old versions of Firefox running Adobe Acrobat 7 are vulnerable.

Because the combinations of these old software versions are rare, it would not be worth a hacker writing an exploit for the flaw.

However, Dunham warned that it would be easy to manipulate the flaw on machines running the combinations.

IDefense said that the best way to fix the problem is to update Adobe Acrobat to version 8.

Originally, iDefense and Symantec had claimed that the flaw could allow cyber-intruders to attack PCs using trusted web links, and that "virtually any website hosting portable document format, or PDF, files are vulnerable to attack".