"A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited," says Adobe.
Adobe expects to make available an update for Adobe Reader 9 and Acrobat 9 by March 11th, 2009. Updates for Adobe Reader 8 and Acrobat 8 will follow soon after, with Adobe Reader 7 and Acrobat 7 updates to follow. In the meantime, Adobe is in contact with anti-virus vendors, including McAfee and Symantec, on this issue in order to ensure the security of our mutual customers.
.
The hole is already being exploited, according to Symantec and McAfee. Both companies suggest you should disable JavaScript by going to Edit, selecting Preferences and then JavaScript, then unchecking Enable Acrobat JavaScript.
Ars Technica says:
Meanwhile, users of Mac OS X can do a couple things to mitigate the issue. One easy step is to set Preview to handle opening all PDF documents. If Preview is not already the default:
Select a PDF file in the Finder
Select File > Get Info (cmd-I)
Under "Open with:", choose Preview from the drop down menu
Finally, click the "Change All..." button
The security problem seems to be susceptibility to a buffer overflow attack, but it's not yet clear how dangerous it's going to be.
Update: For more info and suggestions, see Sophos: PDF exploit - proactive detection confirmed
