As it turned out, Windows XP and Internet Explorer 7 have a little difficulty with parsing filenames that contain percent signs (%). A maliciously crafted URL that points to a PDF file can have XP launch executable code after it launches the reader for the PDF file. While it wasn't Acrobat or Reader that triggered the launch, a fix from Adobe issued today purports to thwart the launch, keeping the system secure.
BetaNews downloaded and tested Adobe's 8.1.1 patch for Acrobat Professional, with a proof-of-concept URL that we had seen previously load the Windows Calculator as proof it could launch any code without security checks. Now the application instead pulls up a dialog box, which reads, "Acrobat does not allow connection to: mailto:test%../../../../../../../../windows/system32/calc.exe".cmd"
Today's updates work with version 8 of the reader software. In its advisory to users today, Adobe said a future update will be made available for version 7.
Adobe, PDF, Security, Vulnerability, Exploit, Security Update, Patch, Release