*Heads up* Adobe Vulnerability Exploited in Targeted Attacks

I'm just going to copy paste here.. (3:40 in the morning, tired; studying for CCIE - Security, written :) )

From ISC

Quote:

---

Adobe's PSIRT (Product Security Incident Response Team) published a new blog post today [1]. The post reveals that a critical vulnerability, CVE-2009-3459, is now being exploited in the wild in targeted attacks. The vulnerability affects Adobe 9.1.3 on Windows, Unix and OS X. However, the exploits have been limited to Windows so far.

An update scheduled to be released on Oct 13th should fix the problem. Until then, Windows users are advised to enable DEP. Anti malware vendors have been informed by Adobe.

This vulnerability does not require Javascript. If you disabled Javascript in the past, it will not protect you in this case. Another workaround I found helpful: You can "clean" PDF documents by first converting them into another format (like Postscript) and then back into PDF. However, this is not 100% certain to remove the exploit and you may infect the machine that does the conversion as it will likely still use the vulnerable libraries to convert the document. But the likelyhood of this happening is quite low.

---

http://blogs.adobe.com/psirt/2009/10...t_issue_1.html

I read this just as i was going to shut down

Quote:

---

Adobe Reader and Acrobat 9.1.3 customers with DEP enabled on Windows Vista will be protected from this exploit.

---

Crap..... I just spent 7 hours installing new adobe products for a client and ensuring they were all updated to 9.1.3 ........ This included Adobe Reader 9.1.3 on EVERY computer plus various adobe retail products such as creator and acrobat.

Of course, the silver lining is now I can charge for preventing yet another security exploit *sigh* I love my job... :D

Hopefully the issue will get resolved in their next update release.... otherwise it simply leaves a larger timeframe for more potential damage to be done.