Adobe Reader, Acrobat v7 vuln in IE - update available

FYI…

- http://www.adobe.com/support/security/advi…/apsa06-02.html
November 28, 2006
"… Platform: Windows
Summary: Adobe is aware of a recently published report of potential vulnerabilities in Adobe Reader and Acrobat. These vulnerabilities would cause the application to crash and could potentially allow an attacker to take control of the affected system.
Affected software versions: Adobe Reader 7.0.0 through 7.0.8 and Adobe Acrobat Standard and Professional 7.0.0 through 7.0.8 on the Windows platform when using Internet Explorer. Users of other browsers are not affected…
Solution: The Secure Software Engineering team is working with the Adobe Reader Engineering team on an update to Adobe Reader and Acrobat 7.0.8 that will resolve these issues, which is expected to be available in the near future. A security bulletin will be published on http://www.adobe.com/support/security as soon as that update is available. The vulnerability is in an ActiveX control used by Internet Explorer; users of other browsers are not affected. The following workaround will prevent these vulnerabilities from occurring in Adobe Reader 7.0.X on Windows using Internet Explorer:
1. Exit Internet Explorer and Adobe Reader.
2. Browse to :\Program Files\Adobe\Acrobat 7.0\ActiveX.
Note: If you did not install Acrobat to the default location, browse to the location of your Acrobat 7.0 folder.
3. Select AcroPDF.dll and delete it.
NOTE: This workaround will prevent PDF documents from opening within an Internet Explorer window. After applying this workaround, clicking on PDF files within Internet Explorer will either open in a separate instance of Adobe Reader or the user will be prompted to download the file, which can then be opened in Adobe Reader. This workaround may disrupt some enterprise workflows and use of PDF forms…"

> http://secunia.com/advisories/23138/

FYI…

- http://www.adobe.com/support/security/bull…/apsb06-20.html
December 5, 2006
"Summary:
Critical vulnerabilities have been identified in Adobe Reader and Acrobat 7.0 through 7.0.8 that could — although Adobe is not aware of any specific code exploits at this time — allow an attacker who successfully exploits these vulnerabilities to take control of the affected system. A malicious file must be by the end user for an attacker to exploit these vulnerabilities. It is recommended that users update to Adobe Reader 8 or apply the workaround provided below.
>Affected software versions
Adobe Reader 7.0 through 7.0.8 and Adobe Acrobat Standard and Professional 7.0 through 7.0.8 on the Windows platform when using Internet Explorer. Users of other browsers are not affected.
> Solution:
Adobe Reader 7.0 through 7.0.8 users should upgrade to Reader 8: http://www.adobe.com/products/acrobat/readstep2.html .
Adobe Reader 7.0 through 7.0.8 users who cannot upgrade to Reader 8, as well as Adobe Acrobat 7.0 through 7.0.8 users, should follow the directions below to update their installations:
1. Exit Internet Explorer, Adobe Reader, and Adobe Acrobat, if necessary.
2. Browse to :\Program Files\Adobe\Acrobat 7.0\ActiveX.
Note: If you did not install Acrobat to the default location, browse to the location of your Acrobat 7.0 folder.
3. Select AcroPDF.dll and delete it.
4. Download the AcroPDF.dll file provided here*.
5. Copy the new AcroPDF.dll file in to the ActiveX directory…"

* http://www.adobe.com/support/security/bulletins/acropdf.dll