News

EMET Wards Off Adobe Exploits, Microsoft Says

Microsoft is heralding its newly released Enhanced Mitigation Experience Toolkit (EMET) 2.0 as a fail-safe against hacker incursion methods.

The company even suggested in this blog post late last week that EMET could help stave off recent attacks associated with Adobe Systems Inc.'s software, specifically Adobe Reader and Adobe Acrobat running on Windows systems. Adobe has issued a security advisory (APSA10-02) regarding a new "critical" vulnerability in Adobe Reader 9.3.4 (and earlier versions) on Windows, Macintosh and Unix. The security advisory also covers Adobe Acrobat 9.3.4 (and earlier versions) on Windows and Macintosh.

The exploit apparently uses a hacker code-writing approach called Return Oriented Programming. This technique is used to bypass the Data Execution Prevention protection feature in Windows.

The good news, wrote Fermin Serna and Andrew Roths (two engineers with the Microsoft Security Response Center), is that if users have EMET enabled, the flaws in Adobe's Reader and Acrobat software can be headed off at the pass. Normally, Address Space Layout Randomization (ASLR) would help prevent such exploits. However, Adobe products are shipped with a Dynamic Link Library (DLL) configuration that doesn't have ASLR enabled, Microsoft's security engineers explained.

Adobe this week announced they will be releasing a patch for this security flaw during the week of Oct. 4, 2010. The release will be in advance of Adobe's regular quarterly patch schedule to meet the threat.

"This security bulletin will address a vulnerability affecting Adobe Reader and Acrobat that is currently being exploited in the wild," explained Jason Miller, data and security team manager at Shavlik Technologies.

Additionally, Adobe this week announced a new security advisory (APSA10-03) describing the same critical vulnerability in Adobe Flash Player. This vulnerability is being "exploited in the wild," according to Adobe. The advisory applies to Adobe Flash Player 10.1.82.76 (and earlier versions) for Windows, Linux, Macintosh and Solaris. It also applies to Adobe Flash Player 10.1.92.10 76 (and earlier versions) for Android. The patch is expected to be available during the week of Sept. 27.

As for the Microsoft EMET solution, it's important to note that the workarounds described by Microsoft's Serna and Roths only work on Windows 7, Vista and Windows Server 2008.

As for protecting against the Acrobat/Reader exploit on Windows XP and Server 2003, EMET's export address table access filtering mitigation also works, if nominally, to remediate the issue through the Windows Kernel32.DLL's export address table.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Google IDs on Azure Active Directory B2B Service Now at 'General Availability'

    Microsoft announced on Wednesday that users of the Google identity and access service can use their personal log-in IDs with the Azure Active Directory B2B service to access resources as "guests."

  • Top 4 Overlooked Features of a Data Backup Strategy

    When it comes to implementing an airtight backup-and-recovery plan, these are the four must-have features that many enterprises nevertheless tend to forget.

  • Microsoft Bolsters Kubernetes with Azure Confidential Computing

    Microsoft on Tuesday announced various developments concerning the use of Kubernetes, an open source container orchestration solution fostered by Google.

  • Windows Will Have Support for Encrypted DNS

    Microsoft announced this week that the Windows operating system already has support for an encrypted Domain Name System option that promises to add greater privacy protections for Internet connections.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.