Adobe has published a security update for a handful of its products after discovering serious vulnerabilities apparently being exploited in the wild.
Issuing a security bulletin, Adobe said the patch is designed for Acrobat DC, Acrobat Reader DC, Acrobat 2020, Acrobat Reader 2020, Acrobat 2017, and Acrobat Reader 2017, both on Windows and Mac OS, ZDNet reported.
Adobe described the patched flaws, labeled as CVE-2021-28550, as “critical” and “important”, saying they were being exploited in the wild, and, if successfully exploited, could lead to arbitrary code execution. It basically means the attacker could use the productivity programs to run various types of malicious code on the target machine.
- Here’s our list of the best free PDF readers right now
- We’ve built a list of the best free PDF editors on the market
- Check out our list of the best firewalls available
Discussing the threat with ZDNet, senior cyber threat intel analyst at Digital Shadows, Sean Nikkel, said nation-states frequently use malicious PDF files in their cybercriminal activities mostly due to the ubiquity of Adobe products, both in private and public sectors.
Describing the Adobe suite as the “Microsoft of a lot of office productivity software”, he said that criminals often hide malware in fake financial documents, shipping labels or news articles, which often come in the PDF format.
Remote working as a liability
Nikkel also said that criminals don’t shy away from creating a malicious website where they could host weaponized PDF files.
"Generally, PDF documents, which frequently are opened either via browser or a reader such as Adobe Acrobat or Reader, can contain malicious Javascript or allow some other system interaction that allows code execution or other vectors of attack to occur, sometimes without the user knowing,” he explained.
Nikkel believes that the major increase in attacks, that’s been spotted recently, can be attributed to remote working. With many employees accessing corporate networks via home devices, cybercriminals have been hard at work at trying to exploit them.
In many cases, they succeed, due to the fact that remote workers are no longer under the protection of their corporate IT network and security experts.
- Here's our list of the best antivirus out there
Via: ZDNet
