Attack of the PDFs

TalkBack 1 of 57:

Next »

• Thread View
• Flat View

Adobe's misleadingly broken 7.0.x updater

So, so far there's no fix for anything earlier than version 8.0. (And BTW have you read Adobe's wording in their release about this? It says that the update "may be installed" over 8.0. As a technical writer, I can tell you that that's weasel-wording; it signals to me that Adobe may well not have fully tested whether or not the update for 8.l.1 actually fixes 8.0.) And so in Acrobat 7.0.9 Professional, when I check for updates, I'm shown a list that indicates that updates are available for 7.0.5, 7.0.7, 7.0.8, and 7.0.9.

So I install the update for 7.0.9, which ultimately requires that I reboot my system. After I do so, and I again check for updates, *I see the same list*.

I have 7.0.9; I shouldn't see updates for earlier versions. I install the update for 7.0.9; I shouldn't see it again.

The broken 7.0.x updater will lull many who check now that they are getting an update that addresses this vulnerability when they're not.

At this point, not having a vulnerability POC site I can go to check whether the fix works, what I'd like to know is this: Since the most recent install of a program that associates a give filetype or filetypes with itself generally grabs associations from existing apps, have I provisionally protected my dopey Acrobat 7.0.9 intallation from automatic IE-vectored drive-bys if I install Acrobat Reader 8.1.1? If so, I should be able to get into trouble with 7.0.9 only if I manually open a PDF file with it.

Or so I imagine.

Posted by: dpnewkirk   Posted on: 10/23/07 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Dell Helps Medical University of South Carolina Bring the Intelligent Classroom to Life Dell Established in 1824, Medical University of South Carolina (MUSC) is one of ... Download Now
• Leveraging SMB ERP for an Economic Recovery ZDNet Times are tough but better days are sure to follow. In the wake of an ... Download Now
• Get top-ranked Novell support for Red Hat when you switch Novell If Linux is going to power your mission-critical applications, you'd ... Download Now