Company calls voluntary updates inadequate

Adobe will start beta testing automatic updates of Reader and Acrobat on January 12th, in parallel with the release of critical security patches, according to the company's director of product security and privacy, Brad Arkin. The test will use the Acrobat Refresh Manager, which was actually installed on people's systems as far back as October, but until now has not been activated. Automatic updates may be offered as a default option as soon as the next scheduled update, set for April 13th.

Reader and Acrobat users will also have the option of downloading updates manually, or else using a "semi-automatic" system in which files are downloaded automatically but not installed until authorized. The current Update Manager notifies users of possible updates, but does not download and install them without prompting. Too many people are postponing patches, Adobe suggests, making themselves more vulnerable to attacks.

The company's PDF tools are a regular target of attack by hackers, in part because it can be easy to trick people into opening malicious documents. Security experts have also complained about the software's handling of JavaScript, a common vector for PDF exploits. Disabling JavaScript entirely within the apps is often recommended.

Use of the Refresh Manager may spread to other products, but Adobe is said to be undecided. "We'll learn from it and see if it's applicable for other products," says Arkin.

by MacNN Staff