More security problems with Flash and Acrobat Reader

[KeithP]

Another day, another security problem:

http://www.adobe.com/support/s...isories/apsa09-03.html

-KeithP

 

[MrChad]

Why would anyone want to embed a Flash file in a PDF? I can't think of a single reasonable use-case.

 

[MustISO]

Yeah, that is just dumb. I think we need to go back to plane HTML, no java, no flash, just simple text files. It won't be pretty but it may cut down on a lot of issues.

 

[mechBgon]

Testing shows that the vulnerability is exploitable on Windows XP and Vista, but the dropped executables do not run on Vista if UAC is enabled.

+1 for UAC as a layer of mitigation :thumbsup: XP Pro/MCE users could always look into Software Restriction Policy as another mitigation, provided they're using non-Admin accounts.

 

[cruzer]

I just had to disable UAC as a requirement to install TVersity. Is there a workaround for this?

 

[Chiefcrowe]

FYI in case anyone missed it, both of these vulnerabilities have been patched and the fixes are now available.