Life and Kraya by Stephen Ramsay
Posts tagged download
Adobe update – excessive traffic to ardownload.adobe.com
Dec 16th
Adobe has not been without its problems of late, and whilst there have been security issues that could have lead to losses, so far none of our clients have suffered financially from Adobe’s failings. Until now that is.
One of our Clients had their ADSL cut off this week as they had exceeded the usage policy. Why? Adobe Update Manager on one Windows XP PC had decided to download over 70GB of data over the course of a 7 day period. It would appear that it was getting itself in a loop and just kept trying to update continuously, 70GB worth of continuously.
The Adobe website serves the update MSI binary files as content type Text/Plain, the Adobe Update client has a very short timeout and immediately opens another connection to re-start the download. Hence if there is a slow connection or the caching server does not return the whole file in a timely manner the Adobe Update client enters the infinite loop of retries, causing the excessive bandwidth consumption witnessed here.
There are several forum threads including on Adobe’s own site http://forums.adobe.com/thread/392129 all linking this issue to a conflict between and old version of WebMarshall and Adobe updater; however our machines do not use WebMarshall and we do not have it installed anywhere on our networks.
We do however use Squid caching on our CentOS 5 servers. The server in this instance seems to be fulfilling the requests on each occasion in a timely manner – the issue is that each time Adobe updater passes a URL it is different in key areas, which Squid interprets as a separate request. This is not abnormal and we have seen this before when we have tried to configure squid to cache Windows updates. However rather than enter a loop of requests, Windows updates simply fail. Other automatic updaters work well with caching systems and indeed most ISPs are now implementing different forms of web caching on their own networks. Dose this mean the Adobe issue is affecting them in the same way?
The issue seems to only affect PCs (or at least we have seen no affected Mac users as yet), and it also seems to affect most Adobe products.
For now Adobe and the ISPs have remained quiet on the issue, however we have 3 other clients (and my own home ADSL ) who cannot update Adobe at all, access to ardownload.adobe.com appears to have been blocked by the ISP. Quite when the Adobe update issue will be resolved is unknown; however we have also taken the decision to block access to ardownload.adobe.com from all of our networks, for the moment.
Richard, one of our Systems Admin Team has published a more detailed account of the technicalities involved here: http://richard.blog.kraya.co.uk/2009/12/16/a-big-adobe-problem/
Security Bulletin – Adobe – April 09
Apr 29th
Yet more security vulnerabilities have come to light in Adobe Reader. All current versions of Adobe Reader and Acrobat (Adobe Reader and Acrobat 9.1, 8.1.4, and 7.1.1 and earlier versions) are vulnerable to this issue on all platforms (Windows, Apple Macintosh and Unix).
The vulnerabilities affect JavaScript functions and could allow remote code execution. This means that if you opened an infected file which contained JavaScript it could be used to install malicious software on your PC. Proof of Concept has been demonstrated. However to date there has been no attacks utilising these vulnerabilities, it is only a matter of time.
Please also note that anti-virus and anti malware / spyware tools are unlikely to pick this issue up at present.
ACCTION NEEDED;
Disabling JavaScript in Adobe Reader and Acrobat will prevent these vulnerabilities from being exploited, however we also advise that clients consider using another PDF reader such as Foxit. You can download Foxit Reader here – http://www.filehippo.com/download_foxit/
Alternatively turn off JavaScript by using the following instructions:
- Launch Acrobat or Adobe Reader.
- Select Edit>Preferences
- Select the JavaScript Category
- Uncheck the ‘Enable Acrobat JavaScript’ option
- Click OK
Adobe Reader Javascript (click on Image to enlarge)
