Adobe PDF Vulnerabilty

UPDATE: Adobe has released a patch for Adobe Reader 9 and Acrobat 9 for Windows and Mac. Information on this latest update and new versions of Adobe Reader and Acrobat can be found here.

A critical vulnerability (APSA09-01) has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability may cause the application to crash and could potentially allow an attacker to take control of the affected system.

There are several reports of this vulnerability being actively exploited.  The attacks so far appear to be small scale and targeted.  However exploit is code is publically available and it is possible more widespread attacks will occur in the near future.  The exploit uses JavaScript components to execute code.  

Adobe has yet to release a patch for this vulnerability. The following workarounds can be implemented to help mitigate the exploit in the meantime.

• Disable JavaScript in Abobe Reader and Acrobat. In Acrobat you can disable JavaScript via:  Edit -> Preferences -> JavaScript - > Un-check "Enable Acrobat JavaScript"
• Disable the display of PDF documents in the web browser.  In Acrobat: Edit -> Preferences -> Internet -> Un-check "Display PDF in browser"
• Prevent Internet Explorer from automatically opening PDF files.  The installer for Adobe Reader and Acrobat configures Internet Explorer to automatically open PDF files without any user interaction.  See US-CERT Alert for more details on how to disable this feature in the Registry.
• And, of course, be wary.

Further information:
Adobe Notification
Shadowserver blog
US-CERT Notification