If you’re an Adobe Reader and Acrobat user, you may have been on edge for the past month with the recent PDF attacks. Well, you’ll be happy to know that the patch is now available for Reader, Acrobat 9 Pro, Standard and Extended for both Windows and Macintosh versions.
Important information to know:
*Updates for Adobe Reader 7 and 8, and Acrobat 7 and 8 are slated for release by March 18.
*The Adobe Reader 9.1 update for Unix will be out by March 25.
*Users with versions 7 and 8 of Adobe Reader and Acrobat, who can’t update their software should more information on immediate protection for this issue from anti-virus and security vendors is available on the Adobe Product Security Incident Response Team blog.
Although the fix may secure your PDF software, it might not do anything to fix your failing sense of security in Adobe software.
It may have been hard the past few weeks to cope through the long period of time without a fully working patch. Adobe, who suggested disabling JavaScript as one of the main solutions, was actually proven ineffective since the malicious code could also be triggered by simply opening a folder on your computer with Windows Explorer. The Windows Shell Extension actually reads the PDF in order to display the information.
The usual PDF reader alternatives also didn’t help to settle the unease. Foxit PDF Reader, for instance, seemed to be hit by a different, yet related vulnerability involving the same JBIG2 image code being parsed by Adobe Reader. Fortunately, that issue has already been fixed faster than Adobe has been able to issue patches for all its software versions.
Without a quick solution, it even led users to take matters into their own hands to develop a temporary homebrewed solution. However, using a distributed homebrewed patch can be just as risky.
So what do you do in a situation like this--without a patch for each Acrobat version available, an official Adobe solution or trust in alternative PDF Readers which are also vulnerable? PDF format alternatives? Abandon Adobe altogether as Security Center Editor for eWeek.com, Larry Seltzer, has already considered? Resort to PDF format alternatives? Or compromise your sense of security for a reliable format?
Let’s face it, although security vulnerabilities are constantly an issue, it’s the PDF—a long established and standardized format that gives you professional cross-platform quality. Is abandoning Adobe and switching to other workflow systems better than waiting around for a software patch time and again?
Tough question? To answer it I guess you would have to ask yourself another: Could you trust the PDF format again?
