Security researchers have discovered a cross-site scripting (XSS) vulnerability affecting the widely used Adobe Acrobat Reader software that could make it easy for attackers to launch malicious code.
The flaw, revealed by security researchers Stefano Di Paola and Giorgio Fedon last week at the Chaos Communications Congress hacker convention in Berlin, could allow attackers to manipulate the Adobe Reader browser plug-in to execute arbitrary JavaScript on the client side simply by adding code to the URL of an online PDF file and getting users to click on the link.
The XSS vulnerability is made possible by the Open Parameters feature in Adobe Reader, which makes it possible to open a PDF file using a URL and specify which content to show and how to display it.
In a Wednesday advisory sent to its Deepsight threat management customers, Symantec warned that because Open Parameters exists in most Adobe Reader applications and browser plug-ins, the flaw could lead to a wave of XSS attacks against client-side targets.
"We may be seeing one of the first significant developments where cross-site scripting attacks are delivered to the client side with extremely high target-to-compromise ratios," according to the Deepsight advisory.
Attackers also could leverage the XSS vulnerability to steal cookie-based authentication credentials and launch additional attacks, Symantec noted.
The flaw is easy to exploit because attackers don't need write access to a PDF document and can add malicious JavaScript to any PDF file link found online, according to a post on the SANS Internet Storm Center blog.
Adobe Systems couldn't be reached for comment.
The vulnerability affects Adobe Reader version 6.0.1 for Windows using Internet Explorer 6 and version 7.0.8 for Windows using Firefox 2.0.0.1, but Adobe has fixed the problem in version 8 of the Reader software.
Security firm Secunia, which recommended upgrading to Adobe Reader 8.0 to fix the problem, didn't see the threat as serious, giving it a rating of "less critical," or 2 on a 5-point scale. Symantec Deepsight rated the severity of the flaw as 6.1 on a 10-point scale.
|
Symantec's Code Red: The Law Enforcement/Anonymous E-Mail Exchange Law enforcement officials negotiated via e-mail for more than two weeks with an Anonymous group member trying to extort $50,000 from Symantec to keep stolen product code off the Internet. |
|
How To Sell IT Security Services To Your Customers Cyberattacks can cost a business thousands, even millions, of dollars, and can deal a death blow to some. Here's how IT solution providers can help guard against malicious attacks. |
|
Cybersecurity Experts: What They Know Could Scare You A recent report based on interviews with security experts in government, business and academia finds more than half in agreement that a worldwide arms race is taking place in cyberspace. |
 More
Slide Shows |
- Insider Threats: The Next Frontier for Security Resellers and SMBs
- Complete Security and Your Bottom Line: Sophos, Value and the Channel
- Tough Threats, Tougher Security: How You Can Leverage New Solutions To Combat A “Targeted Attack” Landscape
- Dark Clouds Ahead: Why the Mid-Market Needs To Ramp Up Cloud Security and How You Can Help Them Get There
