According to researchers in Microsoft’s malware protection center, the vulnerability (CVE-2010-0188) was patched less than a month ago, proving that malicious hackers are quick to find fresh targets for malware.
Microsoft’s Marian Radu explains:
While recently analyzing a malicious PDF file, I noticed a vulnerability exploited by the sample which I’ve never encountered before. After a bit of research I came to the conclusion that this specific sample exploited CVE-2010-0188.
This is a fresh vulnerability, information about which was just published this February. It is described as possibly leading to arbitrary code execution, which is exactly what’s happening.
Madu said the malicious PDF causes Adobe Reader to open and then close. While this is happening, an executable file named a.exe is dropped directly onto the C: drive.
Only Windows users who have not yet updated to the newest version of Adobe Reader are vulnerable to this threat.
Separately, the folks at F-Secure has released a chart showing the gradual growth of Adobe Reader as the most commonly exploited software in targeted attacks.