OS/Platform/Application:

Adobe Acrobat (all current versions)
Adobe Reader (all current versions)

Category: ALERT
Severity: HIGH
Attention: Acrobat and Reader, System Administrators, Desktop Support Personnel.

Summary: Multiple Internet Security Resources are currently reporting the existence of a critical vulnerability in Adobe Systems' popular Acrobat and Reader PDF viewing applications.  Adobe Systems has released a security advisory confirming the vulnerability and also acknowledging that active exploitation of this vulnerability is already occurring on the Internet.

Details of the vulnerability and exploit are scarce at this time but the mechanism of exploitation appears to be the handling of maliciously-crafted .PDF documents. 

Recommended Actions:  Acrobat and Reader users are warned to use extreme caution in the handling of .PDF documents from trusted sources and to avoid the handling of .PDF files from unknown/untrusted sources altogether until a patch has been made available from Adobe Systems.  Users whose work routinely involves the opening of .PDF files from trusted/untrusted sources may wish to consider the use of an alternative PDF viewing application (there are numerous PDF readers available from other vendors). 

Adobe Systems states that it will release updates for each version of Acrobat and Reader soon.  According to the Adobe Security Advisory:

"Adobe expects to make available an update for Adobe Reader 9 and Acrobat 9 by March 11th, 2009. Updates for Adobe Reader 8 and Acrobat 8 will follow soon after, with Adobe Reader 7 and Acrobat 7 updates to follow. In the meantime, Adobe is in contact with anti-virus vendors, including McAfee and Symantec, on this issue in order to ensure the security of our mutual customers. A security bulletin will be published on http://www.adobe.com/support/security as soon as product updates are available."

ITS Actions: N/A

Resources:

Adobe Security Advisory:
http://www.adobe.com/support/security/advisories/apsa09-01.html