810534 - Monitoring Reported 0-Day in Adobe Reader

Status: RESOLVED WORKSFORME

(Plugins Graveyard :: PDF (Adobe), defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

This bug is to track the situation around Adobe Reader 0-day reported here:

http://krebsonsecurity.com/2012/11/experts-warn-of-zero-day-exploit-for-adobe-reader/

Comment 1

[Michael Coates [:mcoates] (acct no longer active)]

I spoke with David Lenoe at Adobe (thanks Alex for connecting).

Based on the below information I recommend we take no action at this time and monitor how the situation develops.

Current situation:
Public Risk
* Adobe sees no evidence of active exploitation in the wild - targeted or widespread.
* They feel confident that if there was exploitation they'd receive samples quickly
* Adobe spoke with Brian Krebs. Brian has talked with Blackhole kit rep and the individual claimed the exploit is not actually in BlackHole at this time.

Addressing the Vulnerability
* Adobe is working with Group-IB (the company who has this exploit) to obtain access to the proof of concept
* Adobe believes they know the root of the problem, but want to verify with POC
* Adobe is ready for an out of band push within about 1 week if they get the POC

Communication Plan
* Adobe will let me know if they see any indications of public exploitation
* Mozilla will let Adobe know if we see a spike in crashes that is likely related to current adobe reader or we have knowledge of public exploitation

Comment 2

[Benjamin Smedberg]

mcoates, can this be opened up/marked WFM now?