Adobe Releasing Security Upgrades Every Three Months

VIP LOUNGE

CLOUD LOGIN

You are here: News > News > Adobe Releasing Security Upgrades Every Three Months

» IT Security NEWS

» 21 May 2009

Adobe Releasing Security Upgrades Every Three Months

Brad Arkin—Adobe's Director of Product Security and Privacy—posted on his blog that Adobe will start releasing security updates four times a year, and each quarterly update will coincide with Microsoft's Patch Tuesday as well. The Patch Tuesday updates are made available by Microsoft every second Tuesday monthly.

Before this plan to do quarterly updates was announced, Adobe merely patched bugs and vulnerabilities during version upgrades, fixing the most used versions first and then working backwards to less used versions. Adobe's new method of updating and upgrading will take place every three months and is aimed at promoting Adobe's dedication to the security of its patrons.

Arkin handles Adobe's hands-on reactive team, the Product Security Incident Response Team (PSIRT) and its down-to-business security team, the Adobe Secure Software Engineering Team (ASSET). Both of these coalitions will be cooperating with the Acrobat and Reader engineers to concentrate on improving the incident response process, hardening the code, and releasing frequent security updates.

A few months back, Adobe patched a number of critical vulnerabilities found in its Acrobat and Reader products via an upgrade, which left most of its customers exposed to hacker attacks for months on end before the upgrade became available. Their new approach to updating patches and fixes is specifically engineered to decrease the amount of time that Adobe needs to fix bugs in its products.

Arkin also mentioned that developers and programmers that aren't within the company will get well-timed dialogues regarding security incidents, concurrent (across version and platform) patches for more affected versions, and quicker turn-around times on patch releases as the company moves forward.

The post also comments that it was coincidence that led to the recent security patch releases on the second Tuesdays for March and May (March 10 and May 12), both of which happened on Patch Tuesdays. In any case, Adobe is preparing to begin its new security update program within the next quarter.

Last March 10, Adobe released the Acrobat 9.1 update for both Mac and Windows, which patches a critical security bug. The hole allowed malicious code to be inserted and run with the user's permission through a modified PDF file. Afterwards, on May 12, Adobe released security updates that patch several holes in its Acrobat and Reader products. This update corrects a recently discovered critical buffer overflow in the JavaScript function getAnnots().