The McAfee security firm found an Adobe Reader vulnerability that reveals where a PDF document is opened, once again Adobe products are the center of attention of security experts after the numerous attacks that have exploited flaws in its products for cyber espionage campaigns.
McAfee provided only general information to the press for obvious reasons not supplying details of the Adobe Reader vulnerability that affect all Adobe Reader versions, including last one.
It must be clear that the Adobe Reader vulnerability discovered doesn’t allow remote code execution, anyway McAfee consider it a security issue and have alerted the Adobe company.
The blog post reported:
“Recently, we detected some unusual PDF samples. After some investigation, we successfully identified that the samples are exploiting an unpatched security issue in every version of Adobe Reader including the latest “sandboxed” Reader XI (11.0.2). Although the issue is not a serious problem (such as allowing code execution), it does let people track the usage of a PDF. Specifically, it allows the sender to see when and where the PDF is opened.”
The Reader doesn’t provide information on the availability of the external resource, if doesn’t exist in fact the API doesn’t display any message and returns any TCP traffic.
The information could be collected by the attacker to gather information on the target as explained in the post:
“An APT [advanced persistent threat] attack usually consists of several sophisticated steps. The first step is often collecting information from the victim; this issue opens the door.”
(Security Affairs – Security)