Adobe Systems Inc. confirmed this week that it's looking into chatter that its PDF viewing software, Adobe Reader, contains a critical vulnerability. IT security experts are mixed on the urgency of the patch, mainly because the application isn't mission-critical, but also because of cumbersome programming concerns and frequent problems with the application.
Storms and other security experts contend that Adobe's patch release behavior is a lot like Microsoft's model was a decade ago, before Microsoft organized its monthly event and rolled out fixes in a more structured way.
"Like Microsoft used to be, Adobe now has a situation where there is continuous batches of publicly known vulnerabilities, minimal mitigation assistance and no known patch release date," Storms said. "Together, these factors make it hard for security teams to see the light at the end of the tunnel."
Indeed, Adobe's frequent sporadic disclosure of vulnerabilities and patches give the impression that it doesn't yet have a formal setup to react to security flaws, without going through normal product cycles.
"The more frequently a vendor releases patches, the more lax a customer may get," said Eric Schultze, CTO, Shavlik Technologies. "Why should I install a new version of XYZ software today, when in two weeks I'll only have to reinstall a newer version? While it's great that they fix items as they're found, a high level of frequent releases can lead to a high level of installation apathy."
Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.