Comments on: New BackDoor Attacks Using PDF Documents http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents/ Cutting edge security research as it happens....... Fri, 12 Mar 2010 09:55:48 -0600 http://wordpress.org/?v=2.8.3 hourly 1 By: New 0-Day Attacks Using PDF Documents « I like sex http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents/comment-page-1/#comment-840901 New 0-Day Attacks Using PDF Documents « I like sex Fri, 24 Jul 2009 09:18:03 +0000 http://www.avertlabs.com/research/blog/?p=806#comment-840901 [...] 0-Day Attacks Using PDF Documents As we already mentioned multiple times in the past, exploits that take advantage of newly discovered holes in popular applications represent a growing [...] [...] 0-Day Attacks Using PDF Documents As we already mentioned multiple times in the past, exploits that take advantage of newly discovered holes in popular applications represent a growing [...]

]]> By: Computer Security Research - McAfee Avert Labs Blog http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents/comment-page-1/#comment-840245 Computer Security Research - McAfee Avert Labs Blog Thu, 23 Jul 2009 03:47:17 +0000 http://www.avertlabs.com/research/blog/?p=806#comment-840245 [...] As we already mentioned multiple times in the past, exploits that takes advantage of a newly discovered holes in popular applications represent a [...] [...] As we already mentioned multiple times in the past, exploits that takes advantage of a newly discovered holes in popular applications represent a [...]

]]> By: Adobe Reader and Acrobat JBIG2 buffer overflow vulnerability — Think-Security http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents/comment-page-1/#comment-808774 Adobe Reader and Acrobat JBIG2 buffer overflow vulnerability — Think-Security Thu, 04 Jun 2009 13:16:54 +0000 http://www.avertlabs.com/research/blog/?p=806#comment-808774 [...] http://www.adobe.com/support/security/bulletins/apsb09-03.html http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents... http://jbig2.com/ http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219 [...] [...] http://www.adobe.com/support/security/bulletins/apsb09-03.html http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents... http://jbig2.com/ http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219 [...]

]]> By: New Adobe Reader Exploit Reminds us why we Love Foxit | Tech Supersite Network http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents/comment-page-1/#comment-782167 New Adobe Reader Exploit Reminds us why we Love Foxit | Tech Supersite Network Wed, 22 Apr 2009 03:52:15 +0000 http://www.avertlabs.com/research/blog/?p=806#comment-782167 [...] to the McAfee security blog, malicious PDF documents are already in the wild, and have been appearing across the web since [...] [...] to the McAfee security blog, malicious PDF documents are already in the wild, and have been appearing across the web since [...]

]]> By: Asheerq http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents/comment-page-1/#comment-773573 Asheerq Mon, 06 Apr 2009 03:37:45 +0000 http://www.avertlabs.com/research/blog/?p=806#comment-773573 i thinx adobe update it now thanx dear i thinx adobe update it now
thanx dear

]]> By: Adobe Reader and Acrobat JBIG2 buffer overflow vulnerability | JBIG2 Buffer Overflow | JBIG2 Vulnerability | AntiVirusConnection http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents/comment-page-1/#comment-757182 Adobe Reader and Acrobat JBIG2 buffer overflow vulnerability | JBIG2 Buffer Overflow | JBIG2 Vulnerability | AntiVirusConnection Thu, 12 Mar 2009 09:41:33 +0000 http://www.avertlabs.com/research/blog/?p=806#comment-757182 [...] http://www.adobe.com/support/security/bulletins/apsb09-03.html http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents... http://jbig2.com/ http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219 [...] [...] http://www.adobe.com/support/security/bulletins/apsb09-03.html http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents... http://jbig2.com/ http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219 [...]

]]> By: LouNaTech http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents/comment-page-1/#comment-756690 LouNaTech Wed, 11 Mar 2009 17:41:14 +0000 http://www.avertlabs.com/research/blog/?p=806#comment-756690 Adobe's Patch Is Released for Acrobat Reader 8.x & 9.x Adobe recommends Adobe Reader users update to Adobe Reader 9.1, available here: http://get.adobe.com/reader/ Acrobat 9 Adobe recommends Acrobat 9 Standard and Acrobat 9 Pro users on Windows update to Acrobat 9.1, available at the following URLs: http://www.adobe.com/support/downloads/detail.jsp?ftpID=4375 http://www.adobe.com/support/downloads/detail.jsp?ftpID=4382 Adobe recommends Acrobat 9 Pro Extended users on Windows update to Acrobat 9.1, available here: http://www.adobe.com/support/downloads/detail.jsp?ftpID=4381 Adobe recommends Acrobat 9 Pro users on Macintosh update to Acrobat 9.1, available here: http://www.adobe.com/support/downloads/detail.jsp?ftpID=4374 Still no talk of the vulnerability of Acrobat 6.x Adobe’s Patch Is Released for Acrobat Reader 8.x & 9.x

Adobe recommends Adobe Reader users update to Adobe Reader 9.1, available here:
http://get.adobe.com/reader/

Acrobat 9

Adobe recommends Acrobat 9 Standard and Acrobat 9 Pro users on Windows update to Acrobat 9.1, available at the following URLs:
http://www.adobe.com/support/downloads/detail.jsp?ftpID=4375
http://www.adobe.com/support/downloads/detail.jsp?ftpID=4382

Adobe recommends Acrobat 9 Pro Extended users on Windows update to Acrobat 9.1, available here:
http://www.adobe.com/support/downloads/detail.jsp?ftpID=4381

Adobe recommends Acrobat 9 Pro users on Macintosh update to Acrobat 9.1, available here:
http://www.adobe.com/support/downloads/detail.jsp?ftpID=4374

Still no talk of the vulnerability of Acrobat 6.x

]]> By: Daniel Y http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents/comment-page-1/#comment-751133 Daniel Y Mon, 02 Mar 2009 22:41:08 +0000 http://www.avertlabs.com/research/blog/?p=806#comment-751133 There are a few new PoC at milworm that do not appear to be detected by VirusScan using the most recent DAT release. I've submitted some samples to AVERT in hope that an updated DAT will come out soon. According to http://secunia.com/blog/44/, they created some samples that proof disabling javascript in Acrobat/Reader does not mitigate the risk. VirusScan buffer overflow protection may help for users running Internet Explorer, but not firefox users. There are a few new PoC at milworm that do not appear to be detected by VirusScan using the most recent DAT release. I’ve submitted some samples to AVERT in hope that an updated DAT will come out soon. According to http://secunia.com/blog/44/, they created some samples that proof disabling javascript in Acrobat/Reader does not mitigate the risk. VirusScan buffer overflow protection may help for users running Internet Explorer, but not firefox users.

]]> By: User Solutions » Blog Archive » Serious security vulnerability hits Adobe Acrobat Reader 9 and earlier http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents/comment-page-1/#comment-747858 User Solutions » Blog Archive » Serious security vulnerability hits Adobe Acrobat Reader 9 and earlier Thu, 26 Feb 2009 21:32:01 +0000 http://www.avertlabs.com/research/blog/?p=806#comment-747858 [...] are reports that exploits are already making the rounds and if these are accurate, which they appear to be, look [...] [...] are reports that exploits are already making the rounds and if these are accurate, which they appear to be, look [...]

]]> By: Joe Blough http://www.avertlabs.com/research/blog/index.php/2009/02/19/new-backdoor-attacks-using-pdf-documents/comment-page-1/#comment-747679 Joe Blough Thu, 26 Feb 2009 14:37:57 +0000 http://www.avertlabs.com/research/blog/?p=806#comment-747679 There is exploit code (in the form of a perl script) at milworm. The script will generate a pdf file that contains the exploit. As of last night, 2 out of 39 AV programs on virustotal detect the milworm file as a threat. When tested on acrobat 6 running on Windows 98, acrobat displays a message that the file is corrupt and can't be read. It does not crash. I take that as an indication that Acrobat 6 is not vulnerable to the exploit. Windows-98 wins again over NT-based OS's. There is exploit code (in the form of a perl script) at milworm. The script will generate a pdf file that contains the exploit. As of last night, 2 out of 39 AV programs on virustotal detect the milworm file as a threat. When tested on acrobat 6 running on Windows 98, acrobat displays a message that the file is corrupt and can’t be read. It does not crash. I take that as an indication that Acrobat 6 is not vulnerable to the exploit. Windows-98 wins again over NT-based OS’s.

]]>