Adobe Finally Fixes Remote Launch 0-Day 82
Trailrunner7 sends in this excerpt from Threatpost (Adobe announcement here): "Adobe today shipped a critical Reader/Acrobat patch to cover a total of 17 documented vulnerabilities that expose Windows, Mac, and Unix users to malicious hacker attacks. The update, which affects Adobe Reader/Acrobat 9.3.2 and earlier versions, includes a fix for the outstanding PDF '/Launch' functionality social engineering attack vector that was disclosed by researcher Didier Stevens. As previously reported, Didier created a proof-of-concept PDF file that executes an embedded executable without exploiting any security vulnerabilities. The PDF hack, when combined with clever social engineering techniques, could potentially allow code execution attacks if a user simply opens a rigged PDF file." Relatedly, Brian Krebs blogs about the downsides of Adobe's increasingly Byzantine update process.
It's not a 0-day anymore.... (Score:5, Insightful)
Re:Still I don't know (Score:1, Insightful)
Don't get fooled into thinking a non-admin account is safe. Sure, unless you're root they probably can't set up a mail server, but check out all the files in your Documents directory. See anything the has financial information? Maybe a password list (encrypted or not)? How about email, do you store it on your computer? Do you use your browser to access any useful websites like email or banking sites? If you create a dummy account with highly restricted access (ie, you know what you're doing) you can protect yourself pretty well. Running a VM you never use for anything important is even better. Being complacent and thinking they'll never write a virus for Linux is a recipe for disaster (Google Gentoo malware, Unreal IRC malware, etc. and see how malware made it into REPOSITORIES let alone can be installed as a trojan).
Re:It's not a 0-day anymore.... (Score:3, Insightful)
Nope. Exploitation and disclosure are two completely different things.
If you've found an unpatched exploit and you're a black hat, are you going to blog to the whole world about it? Or quietly add it to your botnet kit without telling anyone?
If the second, it's a 0-day. No warning, no defense, no lead time, just blam, click the wrong web page, read the wrong email, or open the wrong PDF and you're rooted without knowing it.