Hacker Discovers Serious Vulnerability in PDF Files

The same hacker who discovered the recently patched Quicktime flaw in Firefox claims to have found an equally serious flaw in Adobe's PDF format.

Completely ignoring well known exclamation point rationing rules, Petkov recently raised the alarm on the GNUCitizen blog. “Adobe Acrobat/Reader PDF documents can be used to compromise your Windows box. Completely!!! Invisibly and unwillingly!!!,” Petkov wrote in a recent blog posting. “All it takes is to open a PDF document or stumble across a page which embeds one.”

According to Petkov the exploit has been confirmed with Adobe Reader 8.1 on Windows XP, though it’s possible other versions may be affected as well. Since the flaw seems to involve the way files are read, third party PDF apps, like Apple's Preview, could also be affected.

Petkov says he has informed Adobe and will not release the code demonstrating the attack works until Adobe provides a patch.