Information Technology Services

From Adobe Security Bulletin: Buffer overflow issue in versions 9.0 and earlier of Adobe Reader and Acrobat

"A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited.

Adobe is planning to release updates to Adobe Reader and Acrobat to resolve the relevant security issue. Adobe expects to make available an update for Adobe Reader 9 and Acrobat 9 by March 11th, 2009. Updates for Adobe Reader 8 and Acrobat 8 will follow soon after, with Adobe Reader 7 and Acrobat 7 updates to follow. In the meantime, Adobe is in contact with anti-virus vendors, including McAfee and Symantec, on this issue in order to ensure the security of our mutual customers. A security bulletin will be published on the Security Bulletins and Advisories page as soon as product updates are available."

UNCG Information Technology Services (ITS) recommends users perform the following actions, which may help prevent this vulnerability from being exploited: Disable JavaScript in Adobe Reader and Acrobat.

Acrobat JavaScript can be disabled in the General preferences dialog of Acrobat:

1. Open the Edit menu
2. Choose Preferences
3. Choose JavaScript
4. Uncheck "Enable Acrobat JavaScript"
   

Prevent Web Browser from automatically opening PDF documents

The installer for Adobe Reader and Acrobat configures your web browser to automatically open PDF files without any user interaction. This behavior
can be reverted to the safer option of prompting the user by performing the following steps:

Microsoft Windows:

1. Open Adobe Acrobat Reader
2. Open the Edit menu
3. Choose the preferences option
4. Choose the Internet section
5. Uncheck the "Display PDF in browser" check box

Macintosh:

1. Open Adobe Acrobat Reader
2. Open the Adobe Reader menu
3. Choose the preferences option
4. Choose the Internet section
5. Uncheck the "Display PDF in browser" check box
   

As a reminder, users should not access PDF documents from untrusted sources. Furthermore, users should not open unfamiliar or unexpected PDF documents, particularly those hosted on web sites or delivered as email attachments.

ITS will continue to update the UNCG Community as Adobe releases updates to fix this critical vulnerability.

If you have any questions about or difficulties with the patch, please contact 6-TECH at (336) 256-TECH (8324) or 6-TECH@uncg.edu.