Adobe admits users vulnerable after downloading Reader

Confirms updater doesn't always work, says it's reevaluating patch install process

Adobe has acknowledged that some users are vulnerable to attack after downloading an outdated version of Reader from its Web site, and said it is now reevaluating how it updates the popular PDF reader.

Yesterday, Brad Arkin, Adobe's director for product security and privacy, responded to claims by Danish security vendor Secunia that the currently-available version of Reader contains numerous bugs, and that Adobe's update process can leave users vulnerable for days or even weeks.

"We do single-dot releases, such as [Reader] 9.1, as full installers," explained Arkin, referring to the version Adobe released in mid-March to plug several holes, including one that had been exploited by hackers since early January. "The double-dot releases, like 9.1.1 and 9.1.2, those are for patches only and work only with a full-installed version in place."

The single-dot releases, such as Reader 9.1, must meet a different quality level for testing than the patch releases. Doing it that way will "get security fixes faster to users," Arkin said. "That helps keep users up-to-date."

Patch-only updates are common in software, but the problem with Adobe's practice is that it continues to provide an out-of-date edition that many times isn't updated with the latest patches, argued Secunia on Monday. Adobe has issued two security updates since Reader 9.1's debut. The first, released May 12, patched a "zero-day" bug in Reader, while the second, issued June 9, fixed 13 or more flaws.

"Adobe does have the Adobe Updater, which will eventually update Reader to the patched versions," said Mikkel Winther, the manager of Secunia's PSI partner program yesterday. "But sometimes it takes days or weeks for the updater to come up."

By default Adobe's updater pings the company server once a week.

Adobe's Arkin admitted that the updater doesn't always work as it's supposed to. "The intended behavior of the updater is that when you launch Reader for the first time, it will check if there are any updates available," he said. "That's its intended behavior, but there are a lot of [PC] configuration factors that might lead to different behavior."

Arkin confirmed that a first-launch of Reader sometimes fails to trigger Adobe's updater on PCs in its own labs. The updater failed to appear after launching Reader 9.1 for the first time on three different Windows PCs that Computerworld tested.

Read more: Australian PC users worse at patching Windows than New Zealanders, but both lead US: Secunia

Abode is also reevaluating how frequently its software updater pings the company's servers to see whether a patch is ready for download. Currently, the updater defaults to weekly intervals, with monthly intervals the only other option. "We decided that's the right amount of time after feedback from enterprises," said Arkin. He declined to specify what changes Adobe is considering for the updater, and whether those may involve more interval choices for users or a shorter interval, perhaps a daily check for updates, that would be set by default.

"Security patching is also part of the overall security process," Arkin said.

Two months ago, Adobe announced it had seen the security light, and promised it would root out bugs in older code, speed up the patching process and release regular security updates for Reader. The first quarterly update was issued last month.

Hackers continue to hammer Reader. According to New York-based CA today, there are "a vast number of malicious PDF files in circulation on the Internet," many of them pitching multiple exploits at Windows users.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags adobeexploits and vulnerabilitiessecuniapdf bugadobe reader

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?