Security
Adobe Flash vulnerability allows attack via PDF
Symantec identifies previously unknown issue
By Ellen Messmer | IDG News Service | Published 10:48, 23 July 09
Symantec has identified a PDF file that exploits a previously unknown vulnerability in an Adobe Flash multi-media component.
Marc Fossi, manager of development at Symantec, said the company has shared information about the malicious PDF file with Adobe and "Adobe is working on a fix."
Also in this channel
Virtualisation, Big Data and BYOD
Check out our Business IT Hub for opinions and briefings. Read more
Adobe says on its blog that it is "investigating this potential issue" and will provide an update as it gets more information.
The Flash vulnerability, believed to be in Adobe Reader 9.0, 9.1. and 9.1.2 and perhaps other Adobe Flash products, allows the attack via the malicious PDF to execute malicious code on the victim's machine. "It allows remote access," said Fossi. "And it's connecting back to a few sites."
Fossi said the malicious PDF, which was submitted to Symantec, is not known to be widespread but it's clearly designed for attack purposes. The malicious PDF allows for "a heap vulnerability, and code execution."
Symantec's anti-virus software would protect against the exploit of the Flash vulnerability and in addition, for those not using Symantec products, if the user-access control in Windows Vista is open, this will also prevent the exploit from executing, Fossi said.
