Adobe has released security updates for Adobe Reader and Acrobat XI (11.0.02) and earlier versions for Windows and Macintosh, and Adobe Reader 9.5.4 and earlier 9.x versions for Linux. These updates address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system.
Because the vulnerabilities are being exploited in the wild in targeted attacks, it is recommended that users of Adobe Reader and Acrobat apply the update as soon as possible. These updates address critical vulnerabilities could cause the application to crash and potentially allow an attacker to take control of the affected system.
Release date: May 14, 2013
Vulnerability identifier: APSB13-15
Priority: See Table Below
CVE number: CVE-2013-2549, CVE-2013-2550, CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2721, CVE-2013-2722, CVE-2013-2723, CVE-2013-2724, CVE-2013-2725, CVE-2013-2726, CVE-2013-2727, CVE-2013-2729, CVE-2013-2730, CVE-2013-2731, CVE-2013-2732, CVE-2013-2733, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-2737, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, CVE-2013-3341, CVE-2013-3342
Update or Complete DownloadUpdate checks can be manually activated by choosing Help > Check for Updates.
- Adobe Reader XI (11.0.03) for Windows is available here: http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows.
- Adobe Reader XI (11.0.03) for Macintosh is available here: http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh.
- Adobe Reader 9.5.5. for Linux is available here: ftp://ftp.adobe.com/pub/adobe/reader/unix/9.x/.
Enable "Protected View"Due to frequent vulnerabilities, it is recommended that Windows users of Adobe Reader and Acrobat ensure that Protected View is enabled. Neither the Protected Mode or Protected View option is available for Macintosh users.
To enable this setting, do the following:
- Click Edit > Preferences > Security (Enhanced) menu.
- Change the "Off" setting to "All Files".
- Ensure the "Enable Enhanced Security" box is checked.
|Image via Sophos Naked Security Blog|