Acrobat flaw could spawn Web attacks
Sunday, January 7th, 2007A security weakness in the ubiquitous Acrobat Reader software could be a boon for cybercrooks, security experts warned on Wednesday in the US.
An error in the Web browser plug-in of Adobe Systems’ tool lets cybercrooks co-opt the address of any Web site that hosts an Adobe PDF file for use in attacks, Symantec and VeriSign iDefense said. An attacker could construct seemingly trusted links and add malicious JavaScript code that will run once the link is clicked, they said.
For example, an attacker could find a PDF file on a bank Web site and then create a hostile link to that file along with malicious JavaScript, Ken Dunham, director of the Rapid Response Team at VeriSign iDefense, said in a statement.
“This vulnerability makes it possible for cross-site-scripting (XSS) attacks to occur, to steal cookies, session information, or possibly create a XSS worm,” he said. XSS attacks put online accounts at risk of hijack and feed information-thieving phishing scams by allowing miscreants to use seemingly trusted links to point to fraudulent Web sites.
The Adobe vulnerability could spark a rise XSS attacks, Symantec said. Such attacks in the past relied on flaws in Web sites, but with the Adobe Reader bug there is now a widely used client-side application that allows cross-site-scripting attacks, it said in an alert sent to users of its DeepSight security intelligence service.
