Critical Security Issue with Adobe Reader/Professional

I can't say it surprises me....

I received an email at work today asking for IT people to make a change to the registry concerning Adobe as there was no patch available.

I'll provide links for you guys to work it out, but here's the synopsis:

You must have Windows XP2

You must have IE7

Issue affects the latest to previous versions of Adobe Reader or Acrobat Professional (8.1 - earlier).

Here's the scenario:

You open up a .pdf document in your email or website link and without warning, arbitrary code is executed on your computer. This is generally pretty serious due to the widespread availability and acceptance of .pdf files.

A patch from Adobe is expected at the end of the month.

So the moral of the story for most of you, be very careful what .pdf files you open. However, if you're feeling brave, there is a simple registry fix to get around the flaw and obtain peace of mind.

http://www.adobe.com/support/security/advisories/apsa07-04.html

You can copy and paste this link to the website that discovered the flaw for more info.

http://www.gnucitizen.org/blog/0day-pdf-pwns-windows

And this is a short video detailing someone clicking on a .pdf document and having the notepad and calculator execute (notice that there is no command line prompt or Windows Security Warning). It's pretty safe to say that you can script something a little more malicious than the calculator and notepad executing.

Because I care,

Ashton