News

EMET Wards Off Adobe Exploits, Microsoft Says

Microsoft is heralding its newly released Enhanced Mitigation Experience Toolkit (EMET) 2.0 as a fail-safe against hacker incursion methods.

The company even suggested in this blog post late last week that EMET could help stave off recent attacks associated with Adobe Systems Inc.'s software, specifically Adobe Reader and Adobe Acrobat running on Windows systems. Adobe has issued a security advisory (APSA10-02) regarding a new "critical" vulnerability in Adobe Reader 9.3.4 (and earlier versions) on Windows, Macintosh and Unix. The security advisory also covers Adobe Acrobat 9.3.4 (and earlier versions) on Windows and Macintosh.

The exploit apparently uses a hacker code-writing approach called Return Oriented Programming. This technique is used to bypass the Data Execution Prevention protection feature in Windows.

The good news, wrote Fermin Serna and Andrew Roths (two engineers with the Microsoft Security Response Center), is that if users have EMET enabled, the flaws in Adobe's Reader and Acrobat software can be headed off at the pass. Normally, Address Space Layout Randomization (ASLR) would help prevent such exploits. However, Adobe products are shipped with a Dynamic Link Library (DLL) configuration that doesn't have ASLR enabled, Microsoft's security engineers explained.

Adobe this week announced they will be releasing a patch for this security flaw during the week of Oct. 4, 2010. The release will be in advance of Adobe's regular quarterly patch schedule to meet the threat.

"This security bulletin will address a vulnerability affecting Adobe Reader and Acrobat that is currently being exploited in the wild," explained Jason Miller, data and security team manager at Shavlik Technologies.

Additionally, Adobe this week announced a new security advisory (APSA10-03) describing the same critical vulnerability in Adobe Flash Player. This vulnerability is being "exploited in the wild," according to Adobe. The advisory applies to Adobe Flash Player 10.1.82.76 (and earlier versions) for Windows, Linux, Macintosh and Solaris. It also applies to Adobe Flash Player 10.1.92.10 76 (and earlier versions) for Android. The patch is expected to be available during the week of Sept. 27.

As for the Microsoft EMET solution, it's important to note that the workarounds described by Microsoft's Serna and Roths only work on Windows 7, Vista and Windows Server 2008.

As for protecting against the Acrobat/Reader exploit on Windows XP and Server 2003, EMET's export address table access filtering mitigation also works, if nominally, to remediate the issue through the Windows Kernel32.DLL's export address table.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Microsoft Starting To Roll Out New Excel Connected Data Types

    Microsoft on Thursday announced some Excel and Power BI enhancements that add "connected data types" on top of the standard strings and numbers options.

  • Windows 10 Users Getting New Process for Finding Optional Driver Updates

    Accessing Windows 10 drivers classified as "optional updates" will be more of a manual seek-and-install type of experience, starting on Nov. 5, 2020, Microsoft explained in a Wednesday announcement.

  • Microsoft Changes Privacy Platform Name to SmartNoise

    Microsoft Research has changed the name of its "differential privacy" platform from "WhiteNoise" to "SmartNoise," according to a Wednesday announcement.

  • Why Restarting a Failed SCVMM Job Might Be a Bad Idea

    Occasionally, restarting a failed System Center Virtual Machine Manager job can leave your virtualization infrastructure in an unknown state. Here's how to avoid that.

comments powered by Disqus