Borrowing a few pages from Microsoft's playbook, Adobe today announced plans for a quarterly Patch Day for its Reader/Acrobat product lines and new initiatives to beef up its code hardening and security response processes.
Starting this summer, Adobe Reader and Acrobat security patches will be released on a quarterly schedule and will be timed to coincide with Microsoft's second-Tuesday-of-the month bulletin releases. The new schedule will not include fixes for Adobe Flash Player, Adobe Air or other software products.
Here's the gist of the plans, as outlined by Brad Arkin, director of product security and privacy at Adobe:
- Code Hardening - For the past several years all new code and features for Adobe Reader and Acrobat have been subject to our modern Secure Product Lifecycle (SPLC). The Adobe SPLC is similar to Microsoft’s Security Development Lifecycle (SDL). The Adobe SPLC integrates standard secure software activities such as threat modeling, automated and manual security code reviews, and fuzzing into the standard Adobe Product Lifecycle we follow for all projects.The SPLC activities have been successful in mitigating threats in new code development, but did not fully address problems in the existing code base. Therefore, an initiative in the current security effort has been focused on hardening at-risk areas of the legacy code. We’ve applied the latest SPLC techniques against these prioritized sections of each application. Even in cases where no immediate vulnerability was identified, we have been strengthening input validation on a best-practice basis. (Experience shows such validation is a powerful tool in preventing as-yet unidentified security holes.)
- Incident Response Process Improvements – We’ve targeted several specific areas where we are improving our incident response process. We expect folks outside Adobe will see more timely communications regarding incidents, quicker turn-around times on patch releases, and simultaneous patches for more affected versions as we move forward.This approach was tested sooner than we would have liked with CVE-2009-1492/1493. Although this incident fell in the middle of our security effort, we were encouraged by the progress our response demonstrated. We worked to communicate early and often via our PSIRT blog and two weeks later, on May 12, 2009, we simultaneously shipped 29 binaries to update 17 different versions of Adobe Reader and Acrobat covering 32 languages for the Windows, Mac, and UNIX platforms.
- Regular Security Updates – Starting this summer with the initial output of our security code hardening effort, we plan to release security updates for all major supported versions and platforms of Adobe Reader and Acrobat on a quarterly basis. Based on feedback from our customers, who have processes and resources geared toward Microsoft’s “Patch Tuesday” security updates, we will make Adobe’s quarterly patches available on the same days. (Although our 3/10/09 and 5/12/09 security patches landed on Patch Tuesday, the timing was coincidental. In both cases, we shipped the patches as soon as we finished testing them.)
I had a brief telephone conversation with Arkin today to discuss the plans and he said the changes were a direct result of the "changing threat landscape" affecting Adobe's customers. Over the last year, the company has struggled to cope with numerous exploit code releases and zero-day attacks and its security response process fell short of providing enough information for affected end-users.
These two comparison charts, via F-Secure, show just how much of a target Adobe has become, especially in the area of targeted attacks that use booby-trapped PDF files:
And now 2009 (year to date):
Microsoft's latest Security Intelligence Report (a must read!) also describes the target on Adobe's back -- malware authors consistently exploit Flash Player vulnerabilities -- so this news from Adobe could not have come at a better time.
While the SDL-type process is a no-brainer, I'd also like to see Adobe adobe a security advisory service (outside of the PSIRT) blog that provides some clear mitigation/guidance when exploit code is available for an unpatched vulnerability.