PDF exploit not yet patched

[Lincoln]

Windows users are susceptible to an exploit (http://www.neowin.net/news/main/07/10/09/adobe-admits-pdf-exploit-posts-workaround) that can arrive by opening a PDF file or viewing a webpage with a PDF embedded.
<blockquote>In an advisory posted Friday, Adobe admitted that the flaw first disclosed by Petko Petkov, a U.K.-based security researcher, was real. The San Jose-based company also provided a multiple-step work-around in lieu of a permanent fix to its Adobe Acrobat software and its free Adobe Reader application. </blockquote>
Petkov wouldn't publicly release details, but recommends steering clear of public PDFs until it's patched.

[GHoosdum]

Is this an Adobe-specific exploit, or will it exhibit in all PDF readers? I use FoxIt at home.

[Lincoln]

Is this an Adobe-specific exploit, or will it exhibit in all PDF readers? I use FoxIt at home.
It isn't clear from the article, but I would assume it's likely FoxIt would have the same vulnerability.

Should also note this only pertains to XP users with IE7.

[Zuntar]

Good, I don't use IE7.:p

[GHoosdum]

Nor I. Whew.

[Lincoln]

I don't think it's required that you actually use IE7, only that it is installed. The exploit is with how the protocol for a mailto: link in a PDF is handled (note that you don't have to click it, only open it).

[GHoosdum]

The article makes it seem like the burden lies with Adobe to fix this exploit, but it seems to me that logically it would require a patch to IE7 to solve it for all PDF readers, particularly since it doesn't occur when any other browser is installed.

[Lincoln]

Adobe maintains/owns the PDF technical standard, so I think, logically, the responsibility does lie with them to fix an exploit in it... but I may not fully understand. The article doesn't clear up a lot of things.