Tompkins County Relocalization Project

[Tompkins County Relocalization Project <tcrp-news AT lists.ibiblio.org>]

Sorry for the repeat, but since the original subject line didn't
make it past my spam filter, I figure it might not have made it
past yours, either....

Jon

-------- Original Message --------
Subject: [tcrp-news] Security alert for Adobe Acrobat users on XP
Date: Wed, 31 Oct 2007 09:58:01 -0400
From: Tompkins County Relocalization Project <tcrp-news AT lists.ibiblio.org>
Reply-To: tcrp-news AT lists.ibiblio.org
To: tcrp-news AT lists.ibiblio.org

Hello TCLocal members and observers,

Since we use PDF for just about everything we publish, I thought
it would be helpful to forward this alert.  It comes from the
internal security department of the company I work for (references
to which have been removed).  Note that the easiest way to fix
this is to activate the button marked "Check for updates" (or
something like that) that is generally found on the Help menu of
your application.

Jon

##################################################################

Adobe on Windows XP - Update available for vulnerability in
versions 8.1 and earlier of Adobe Reader and Acrobat

[ORANGE]                Security Alert Summary

     * Critical Vulnerabilities: Update available for vulnerability
       in versions 8.1 and earlier of Adobe Reader and Acrobat

     * Versions Affected:

       Windows XP Platform

       Adobe Reader 8.1 and earlier, Adobe Reader 7.0.9 and earlier
       Adobe Acrobat Professional, 3D and Standard 8.1 and earlier
       versions, Adobe Acrobat Professional, Standard, 3D and
       Elements 7.0.9 and earlier

TO: Windows XP Admins/Users of Adobe Reader and Acrobat
SUBJECT: Update available for vulnerability in versions 8.1 and
    earlier of Adobe Reader and Acrobat
DATE:   October 23, 2007
ACTION: YES -- Read Below

Versions Affected

  * Windows XP Platform
      o Adobe Reader 8.1 and earlier,
      o Adobe Reader 7.0.9 and earlier
      o Adobe Acrobat Professional, 3D and Standard 8.1 and earlier
versions,
      o Adobe Acrobat Professional, Standard, 3D and Elements 7.0.9 and
earlier

We have classified the threat level of this vulnerability as
*CRITICAL as this could easily be exploited by a virus, and PDF
files are frequently used in our environment.

Summary:

Critical vulnerabilities have been identified in Adobe Reader and
Acrobat that could allow an attacker who successfully exploits
these vulnerabilities to take control of the affected system. This
issue only affects customers on Windows XP with Internet Explorer
7 installed. A malicious file must be loaded in Adobe Reader or
Acrobat by the end user for an attacker to exploit these
vulnerabilities. It is recommended that affected users update to
Adobe Reader 8.1.1 or Acrobat 8.1.1. This is an update to resolve
the issue previously reported in Security Advisory APSA07-04.

Details:

This Security Bulletin addresses the issue previously reported in
Security Advisory APSA07-04. Critical vulnerabilities have been
identified in Adobe Reader and Acrobat that could allow an
attacker who successfully exploits these vulnerabilities to take
control of the affected system. This issue only affects customers
on Windows XP with Internet Explorer 7 installed. A malicious file
must be loaded in Adobe Reader or Acrobat by the end user for an
attacker to exploit these vulnerabilities. This issue is remotely
exploitable.

It is recommended that affected users update to Adobe Reader 8.1.1
or Acrobat 8.1.1. Adobe will be providing an update to Adobe
Reader 7.0.9 and Acrobat 7.0.9 at a later date. Adobe Reader 6.X
and Acrobat 6.X are not vulnerable to this issue.

Severity Rating:
Adobe categorizes this update as critical
http://www.adobe.com/support/security/severity_ratings.html

Adobe recommends that users apply this update to their
installations. Learn more:
http://www.adobe.com/support/security/bulletins/apsb07-18.html

Mitigation:

Adobe strongly recommends upgrading to Adobe Reader 8.1.1 or
Acrobat 8.1.1. Users can utilize the product's automatic update
facility. The default installation configuration runs automatic
updates on a regular schedule, and can be manually activated by
choosing Help > Check For Updates Now.

Alternatively, the Adobe Reader 8.1.1 update files can be manually
downloaded and installed from:

http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows

The Acrobat 8.1.1 update files can be downloaded and installed from:

http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows

Microsoft may also be providing an update to resolve this issue at
a later date. Please refer to Microsoft Security Advisory 943521
for more information.

Adobe will be providing an update to Adobe Reader 7.0.9 and
Acrobat 7.0.9 at a later date. For customers who can not upgrade
to Adobe Reader 8.1.1 or Acrobat 8.1.1, administrators can disable
the mailto: option in Acrobat, Acrobat 3D and Adobe Reader by
modifying the application options in the Windows
registry. Additionally, these changes can be added to network
deployments to Windows systems.

RESOURCES

Update available for vulnerability in versions 8.1 and earlier of
Adobe Reader and Acrobat

Adobe Reader 8.1.1 update files

Acrobat 8.1.1 update files

*) see Threat Scale Rating - CRITICAL