A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited.
Adobe has released the Adobe Reader 9.1 and Acrobat 9.1 product updates to resolve this security issue. Adobe recommends users of Adobe Reader and Acrobat 9 update to Adobe Reader 9.1 and Acrobat 9.1. For more information, please refer to Security Bulletin APSB09-03.
Adobe is planning to make available updates for Adobe Reader 7 and 8, and Acrobat 7 and 8, by March 18. In addition, Adobe plans to make available Adobe Reader 9.1 for Unix by March 25. In the meantime, Adobe is in contact with anti-virus and security vendors, including McAfee, Symantec and others, on this issue in order to ensure the security of our mutual customers. More information on protection for this issue from anti-virus and security vendors is now available on the Adobe Product Security Incident Response Team blog.
Reports have been published that disabling JavaScript in Adobe Reader and Acrobat can protect users from this issue. Disabling JavaScript provides protection against currently known attacks. However, the vulnerability is not in the scripting engine and, therefore, disabling JavaScript does not eliminate all risk. Should users choose to disable JavaScript, it can be accomplished following the instructions below:
Bookmarks