Adobe fixes Acrobat hole

Adobe on Monday released patches for Acrobat and its free Reader equivalent to fix a security hole that could leave Mac and Windows computers susceptible to control at the hands of a malicious remote user. Computerworld writes that the "critical" vulnerability has existed in several incarnations of the v8.x.x Acrobat software, but does not apply to users of Acrobat 7.1.0. The patch comes after criticism over Adobe's vague mention of vulnerability fixes in a recent update, as several past JavaScript bugs resurfaced, leaving many users affected.

"Adobe has an epidemic with regards to JavaScript," noted Andrew Storms, director of security operations at nCircle Network Security. "With this many JavaScript bugs in Acrobat, one begins to ask questions. Why would a full, thick application like Acrobat need to be using JavaScript, especially when JavaScript in the browser has historically been a target for hackers? And since JavaScript has been a target for so many years, why hasn't Adobe flushed out these vulnerabilities already?"

by MacNN Staff