New Attacks Targeting Adobe PDF Flaw

Via ThreatPost.com -

There is a new, targeted attack that is going after the Adobe Reader and Acrobat zero-day vulnerability that was disclosed last month. The attack uses a sophisticated JavaScript-based exploit that includes shell code that is just 38 bytes long.

An analysis of the exploit by the SANS Internet Storm Center shows that the attack is quite different from other PDF-based exploits in a number of important ways. Like many previous attacks, this newest exploit uses heap spraying in order to get the application to execute its two-stage shellcode.

[...]

The vulnerability that this attack exploits has not been patched yet. Adobe is scheduled to publish a fix for it on Jan. 12.