PDFs: Not Just For Spam Anymore
"Adobe Acrobat/Reader PDF documents can be used to compromise your Windows box," he wrote Thursday on his blog. "Completely!!! Invisibly and unwillingly!!! All it takes is to open a PDF document or stumble across a page which embeds one."
He described the issue as a high-risk vulnerability of critical importance, given PDF's popularity for business use. PDFs are frequently used to distribute press releases, contracts, designs, manuals, and other material that the creator does not want altered.
Petkov said that because of the importance of PDF as a format, and the fact that "it may take a while for Adobe to fix their closed source product," he would not be publishing any code until Adobe has issued an update. He has reported that Adobe has confirmed the issue.
Many Internet users already dread seeing .pdf appended to any file, but in some businesses the format is absolutely essential. Even though the hacker... I mean "security researcher," didn't release information publicly, the idea that this is possible probably has many bad people working feverishly on finding it right now. Our advice is to be deeply suspicious of any PDF file you receive until Adobe announces a patch for this vulnerability. Hiding under your bed optional, of course.
