Support Overview

Help Desk

Online Service Request

Emergency IT Support

Security Alerts

Computer Usage Tips

Security Alerts

Security Warning: Adobe Reader and Acrobat Vulnerability Being Exploited

An un-patched vulnerability in Adobe Reader and Acrobat (for reading and creating PDF documents) is being actively exploited on the Internet.  Adobe is not planning to release a patch until January 12, 2010.  The vulnerability could potentially allow an attacker to take control of the affected system.  Adobe has posted information about how to work around the vulnerability.

What Should You Do Now

Make sure that your computer is has a workaround for this vulnerability implemented. We have said it before and we will say it again: Disable JavaScript in Adobe Reader and Acrobat.  See "How Do I Protect My Computer" below.

ITPS also recommends that you configure Adobe Reader and your browser to not automatically open PDF files on the Internet in your browser.  This will give you more protection as it will be more obvious when a web site tries to open (a potentially malicious) PDF file on your computer.

What is the Vulnerability

The vulnerability involves JavaScript function within Adobe Reader and Acrobat, but it has been reported that the JavaScript is obfuscated making detection more difficult.

When Adobe learned of the vulnerability, the information was not publicly known, but with all the attention, it will probably become public.  When that happens, more attacks using the vulnerability are likely, making the need for protection that much more critical.

What is the Attack

Initially the attack arrives as a PDF file attachment in an e-mail message.  The attack uses social engineering to lure the recipient into opening the attachment.  The attachment then attempts to infect the computer with a Trojan virus.

If you get an e-mail message that you were not expecting that tries to pressure you into opening an attachment, it is very likely that the attachment is malware and you should delete the message.

As information about the underlying vulnerability becomes public, other attacks are likely.  Malicious PDF files could arrive via a-mail, be downloaded from the web, or many other ways.  Be suspicious of any PDF file that you did not request.

In fact, we are already seeing additional attacks., a new publication in Albany, NY, said on Friday that visitors to the site's comics section began reporting malicious downloads while viewing comics that are attributed to this PDF vulnerability.

Exploits of this PDF vulnerability are now featuring fake Microsoft security certificates. The bogus security certificates signed by Microsoft are used to spoof anti-virus software. The phony certificates are designed to look like real certificates but lack information that genuine security certificates would have.

How Do I Protect My Computer

The easiest way to protect your computer is to disable Java Script in Adobe Reader and Acrobat.  If you need to use Java Script and you are running Adobe Reader or Acrobat versions 9.2 or 8.1.7, you can utilize the JavaScript Blacklist Framework that Adobe added in those versions to provide granular control over the execution of specific JavaScript API calls.

JavaScript has been a frequent attack vector in Adobe Reader and Acrobat, and its functionality is not normally needed.  That is why ITPS has disabled JavaScript in Acrobat Reader and Adobe at all our Managed Care customer sites.  We recommend that you do the same.

To disable Java Script in Adobe Reader or Acrobat on a single computer:

1. Run Adobe Reader or Acrobat.
2. Select Edit>Preferences
3. Select the JavaScript Category
4. Uncheck the 'Enable Acrobat JavaScript' option
5. Click OK

If you have very many computers, this becomes a lot of work.  If you have an Active Directory (AD) domain, you can use a group policy object (GPO) to disable Java Script in Adobe Reader and Acrobat on all (or select groups) of you computers without having to manually disable it on each computer.

To use the JavaScript Blacklist Framework to workaround this vulnerability, see Adobe's instructions at


Adobe: Security Advisory APSE09-07

Adobe: JavaScript Blacklist Framework Mitigation

Symantec: Zero-Day Xmas Present

Computer World: Adobe probes new in-the-wild PDF bug

PCWorld: Adobe Reader Zero-Day Exploit: Protecting Your PC

Computer World: Adobe explains PDF patch delay

The Tech Herald: Funny pages used to launch PDF attack

MX Logic: Adobe exploits now feature faked Microsoft security certificates

Managed Services

IT Professional Services had disabled Java Script in Acrobat and Adobe Reader via a group policy at all of our customers of Managed Care some time ago.  Managed Care customers are protected from this vulnerability.

Professional Services

If you need assistance installing a work around for this vulnerability or  a security assessment, IT Professional Services can help. Call our help desk.

Find out more about our Managed Care service.

To find out how vulnerable your network is schedule a free network security analysis today.

We at IT Professional Services (ITPS) hope that the information in this bulletin is valuable to you. ITPS believes the information provided herein is reliable. While care has been taken to ensure accuracy, your use of the information contained in this bulletin is at your sole risk. All information in this bulletin is provided "as-is", without any warranty, whether express or implied, of its accuracy, completeness, fitness for a particular purpose, title or non-infringement, and none of the third-party products or information mentioned in the bulletin are authored, recommended, supported or guaranteed by ITPS. ITPS shall not be liable for any damages you may sustain by using this information, whether direct, indirect, special, incidental or consequential, even if it has been advised of the possibility of such damages.

Privacy Policy

© 2009-2013 IT Professional Services All rights are reserved.  (805) 650-6030