Acrobat flaw, a malicious PDF escapes antivirus

The critical vulnerability discovered in Adobe Acrobat Reader in December and to date still not corrected, the subject of a new operating via a malicious PDF file undetected by virtually all antivirus software.

On December 15, Adobe acknowledged the existence of a critical security flaw in Adobe Acrobat Reader (version 9.2 and earlier), and announced work on developing a fix expected for January 12.

From December 16, the first Trojan exploiting the vulnerability was detected: Trojan.Pidief.H. A new malware has been detected, hidden in a PDF file. Bojan Zdrnja SANS Institute has identified a load (payload) of only 38 bytes, a size that makes it complex to detect the virus.


The attack is detected by 8 of 41 tested antivirus

According to an analysis of Total Virus, several days after the onset of the attack, only 8 of the 41 major antivirus market would be able to detect it, which is obviously the goal sought by the authors of this malware.

The malicious PDF, sent by email and the origin of which experts said would be Chinese, and is detected by antivirus software: a-squared, BitDefender (7.2), Comodo, F-Secure (9.0), GData, Ikarus, Sophos Trend Micro.

Pending patch Adobe, users are encouraged to be vigilant, disable JavaScript by going into preferences and Acrobat Reader, or to use an alternative software like Sumatra PDF.