Hackers exploiting Reader flaw in Windows
Adobe is patching a critical zero-day vulnerability in Adobe Reader and Acrobat that could enable an attacker to take control of an affected machine.
The vulnerability exists in Adobe Reader X (10.1.1) and earlier versions for Windows and Macintosh, Adobe Reader 9.4.6, and earlier 9.x versions for UNIX, and Adobe Acrobat X (10.1.1) and earlier versions for Windows and Macintosh, Adobe explained in a security advisory.
The U3D memory vulnerability (CVE-2011-2462) could cause a crash and potentially allow an attacker to take control of the system. There are reports that this vulnerability is being actively exploited in limited, targeted attacks in the wild against Adobe Reader 9.x on Windows, Adobe warned. Adobe is taking a multistage approach to fixing the vulnerability. First, the company is planning to release an out-of-cycle security update for the software currently being exploited in the wild, that is, Adobe Reader 9.x and Acrobat 9.x for Windows. That will happen no later than the week of December 12.
