Here we go again : the unpatched Windows URI handling flaw that already led to booby-trapped PDF files being sent out is at work again. Just like the previous attacks this one relies on a malicious PDF file being massively spammed.

Once opened on a vulnerable platform, this PDF file drops a stage-one malware that will disable Windows firewall and then download some more malicious components. The vulnerability leveraged here affects IE7, Adobe Acrobat, and Adobe Reader (version 8.1 or 7.0.9 and earlier) on Windows XP and 2003. Vista is safe from this vulnerability.

Adobe published an updated Acrobat Reader safe from the vulnerability. It can be found here. Microsoft assures a patch for the underlying vulnerability will be out for the Nov,13th cumulative update. Before this, other third-party applications are still at risk.