Security researchers from FireEye on Tuesday said they had identified a PDF zero-day that is being used in active attacks, and that they observed successful exploitation on the latest version of Adobe PDF Reader (9.5.3, 10.1.5, and 11.0.1.).
“Upon successful exploitation, it will drop two DLLs. The first DLL shows a fake error message and opens a decoy PDF document, which is usually common in targeted attacks,” FireEye researchers Yichong Lin, Thoufique Haq, and James Bennett explained in a blog post. “The second DLL in turn drops the callback component, which talks to a remote domain.”
It’s unclear if the sample came as a result of one of FireEye’s clients being targeted, or if the researchers discovered the attacks elsewhere.
While few additional details have been provided at this time, FireEye has provided Adobe’s security team with the sample, and warns users not open any unknown or suspicious PDF files.(This should always be the case!)
Adobe did acknowledge a vulnerability report on Tuesday, assumed to be the issue reported by FireEye.
“We are currently investigating this report and assessing the risk to our customers,” David Lenoe, Adobe’s Product Security Incident Response Team group manager, noted. “We will provide an update as soon as we have more information. Please continue monitoring the Adobe PSIRT blog for the latest information.”
Last week at the Kaspersky Lab Security Analyst Summit in Puerto Rico, Lenoe outlined some of the challenges vendors face with dealing vulnerability report, especially when there is only “partial disclosure”.
SecurityWeek has contacted FireEye for additional details, and this story will be updated as new information becomes available from FireEye or Adobe.
Related: Adobe’s Hunt for Sandbox Bypass Flaw a Frustrating Exercise