Zero-day PDF exploit affects Adobe Reader 11 and earlier versions, researchers say

Adobe is investigating the report, but has yet to confirm that the exploit bypasses the sandbox protection in Adobe Reader 10 and 11

Researchers from security firm FireEye claim that attackers are actively using a remote code execution exploit that works against the latest versions of Adobe Reader 9, 10 and 11.

"Today, we identified that a PDF zero-day [vulnerability] is being exploited in the wild, and we observed successful exploitation on the latest Adobe PDF Reader 9.5.3, 10.1.5, and 11.0.1," the FireEye researchers said late Tuesday in a blog post.

The exploit drops and loads two DLL files on the system. One file displays a bogus error message and opens a PDF document that's used as a decoy, the FireEye researchers said.

Remote code execution exploits regularly cause the targeted programs to crash. In this context, the fake error message and second document are most likely used to trick users into believing that the crash was the result of a simple malfunction and the program recovered successfully.

Meanwhile, the second DLL installs a malicious component that calls back to a remote domain, the FireEye researchers said.

It's not clear how the PDF exploit is being delivered in the first place -- via email or over the Web -- or who were the targets of the attacks using it. FireEye did not immediately respond to a request for additional information sent Wednesday.

"We have already submitted the sample to the Adobe security team," the FireEye researchers said in the blog post. "Before we get confirmation from Adobe and a mitigation plan is available, we suggest that you not open any unknown PDF files."

The Adobe Product Security Incident Response Team (PSIRT) confirmed Tuesday in a blog post that it is investigating a report of a vulnerability in Adobe Reader and Acrobat XI (11.0.1) and earlier versions being exploiting in the wild. The risk to customers is being assessed, the team said.

In response to a request for a status update sent Wednesday, Heather Edell, Adobe's senior manager of corporate communications, said that the company is still investigating.

Sandboxing is an anti-exploitation technique that isolates a program's sensitive operations in a strictly controlled environment in order to prevent attackers from writing and executing malicious code on the underlying system even after exploiting a traditional remote code execution vulnerability in the program's code.

A successful exploit against a sandboxed program would have to leverage multiple vulnerabilities, including one that allows the exploit to escape from the sandbox. Such sandbox bypass vulnerabilities are rare, because the code that implements the actual sandbox is usually carefully reviewed and is fairly small in length compared to the program's overall codebase that could contain vulnerabilities.

Adobe added a sandbox mechanism to isolate write operations called Protected Mode in Adobe Reader 10. The sandbox was further expanded to cover read-only operations as well in Adobe Reader 11, through a second mechanism called Protected View.

Back in November, security researchers from Russian security firm Group-IB reported that an exploit for Adobe Reader 10 and 11 was being sold on cybercriminal forums for between US$30,000 and $50,000. The exploit's existence was not confirmed by Adobe at the time.

"Before the introduction of the sandbox, Adobe Reader was one of the most targeted third-party applications by cybercriminals," Bogdan Botezatu, a senior e-threat analyst at antivirus vendor BitDefender, said Wednesday via email. "If this is confirmed, the discovery of a hole in the sandbox will be of crucial importance and will definitely become massively exploited by cybercriminals."

Botezatu believes that bypassing the Adobe Reader sandbox is a difficult task, but he expected this to happen at some point because the large number of Adobe Reader installations makes the product an attractive target for cybercriminals. "No matter how much companies invest in testing, they still can't ensure that their applications are bug free when deployed on production machines," he said.

Unfortunately Adobe Reader users don't have many options to protect themselves if a sandbox bypassing exploit actually exists, except for being extremely careful of what files and links they open, Botezatu said. Users should update their installations as soon as a patch becomes available, he said.

Join the PC World newsletter!

Error: Please check your email address.

Tags Group-IBonline safetysecurityadobeFireEyeDesktop securityExploits / vulnerabilitiesmalwarebitdefenderintrusion

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?