Abobe’s software has once again been hit by hackers after the company said it was investigating reports of a critical new security vulnerability affecting its Illustrator software.
Proof-of-concept code for an attack was publicised this week and is circulating the web. According to Adobe, the vulnerability can be exploited via a malicious Encapsulated PostScript (.eps) file in Illustrator.
“Adobe is aware of a report of a potential vulnerability in Adobe Illustrator CS4 (CVE-2009-4195),” the company wrote in an advisory. “We are currently investigating this issue and will have an update once we have more information.”
Vupen Security stated in an advisory that the issue is caused by a memory corruption error when processing .eps files containing overly long data, which could allow attackers to crash an affected application or execute arbitrary code by tricking a user into opening a specially crafted file.
The vulnerability is known to affect Illustrator Creative Suite versions 13 and 14.
Adobe’s next round of security updates is slated to come 8 December, although the company did not say whether a fix for the issue would be ready then. The company is, however, planning to update Adobe AIR and Adobe Flash Player to address “critical” security issues.
Earlier this year, Adobe changed its development and patching process to improve security. Part of those changes involved instituting a regular schedule for security releases, which now come the same day as Microsoft’s Patch Tuesday.
“The reason why Adobe’s products…have captured the attention of cyber-criminals is that they are so ubiquitous,” blogged Graham Cluley, senior technology consultant at Sophos. “It’s not an outrageous (gamble) for hackers to assume that you have some Adobe software on your computer, making it a potential avenue for attack.”
Major Taiwan chip assembly and test firm KYEC to sell Jiangsu subsidiary, exit mainland China…
Tesla makes key advances toward advanced self-driving rollout in China as chief Elon Musk meets…
New UK rules bring in basic security requirements for millions of internet-connected devices, aiming to…
Google parent Alphabet sees market capitalisation surge over $2tn on plan to over first-ever cash…
Google asks Virginia federal court to dismiss case brought by US Justice Department and eight…
Snapchat parent Snap reports user growth, revenues in spite of tough competition, in what may…