David Kierznowski, a penetration testing expert specializing in Web application testing, has released proof-of-concept code and rigged PDF files to demonstrate how the Adobe Reader program could be used to launch attacks without any user action.More details over at eWeek.
"I do not really consider these attacks as vulnerabilities within Adobe. It is more exploiting features supported by the product that were never designed for this," Kierznowski said in an e-mail interview with eWEEK.
The first back door (PDF), which eWEEK confirmed on a fully patched version of Adobe Reader, involves adding a malicious link to a PDF file. Once the document is opened, the target's browser is automatically launched and loads the embedded link..
Backdoor discovered in Adobe PDFs
Posted on Monday, September 18 2006 @ 1:15 CEST by Thomas De MaesschalckA British security researcher found a way to manipulate legitimate features of Adobe PDF files to open backdoors for computer attacks.
