For more details please review the official security bulletin.

Universally-accepted file types – including PDF, unfortunately – are one of many ways these hackers gain entry to systems by embedding malicious code into the files. So choosing a PDF software application that fully uses modern mitigation techniques to reduce risk is obviously important. To help you understand the risks and evaluate a vendor’s approach to security, we have recently updated and published the white paper PDF Application Security – How to minimize your risk. It’s available for free from Adobe’s web site.

The white paper contains results of independent third-­party testing on the entire Acrobat family of products, specifically related to security. Adobe Reader X and Adobe Acrobat X produced excellent results in security testing by implementing what security experts call a “defense-in-depth” approach within the software and as offered by the operating system. Adobe Reader XI and Adobe Acrobat XI have improved security and sandboxing even further, and Adobe continues to invest in security. This investment has helped reduce the need for out-­of-­cycle security updates. Note in the diagram below, Adobe Acrobat X only had two out-­of-­cycle security updates, while Adobe Acrobat 9 had seven. Deploying a software patch is a timely and expensive process, so we want to help IT professionals minimize those costs by reducing the number of out-of-cycle patches for the Adobe Acrobat family of products.

If you are considering PDF software based on the licensing cost, please be careful. The days of making software choices based on the quoted price alone – without thorough consideration of security – are long gone. You should be asking vendors about operating system mitigations built into their PDF software, processes in place for addressing security threats, and even how involved the vendor is with the broader security community. To get more details about all the ways the Adobe Acrobat family helps organizations do more with PDF, while also providing advanced security, lower costs, and easier software management, download and read the free white paper, PDF Application Security – How to minimize your risk.

Adobe plans to make available updates for Adobe Reader and Acrobat XI (11.0.01 and earlier) for Windows and Macintosh, X (10.1.5 and earlier) for Windows and Macintosh, 9.5.3 and earlier 9.x versions for Windows and Macintosh, and Adobe Reader 9.5.3 and earlier 9.x versions for Linux during the week of February 18, 2013. Adobe will continue to provide updates on these issues via the Security Advisory section of the Adobe website as well as the Adobe PSIRT blog. Please refer to these resources for any details.

Adobe Acrobat XI has full support for signing documents. Adobe EchoSign is an easy to use online service that allows you to instantly send, eSign, track and file documents securely. Recipients can sign right in their browser on virtually any connected device without downloading a plug-in or having to create an EchoSign account. Using these two products together gives you the ability to complete the entire process of signing documents electronically, and the final signed document can be viewed reliably by anyone with the free Adobe Reader.

It’s simple too!

You can apply your signature with your mouse, text, image or even a digital certificate by opening your PDF document in both Acrobat and Adobe Reader XI and clicking on the I Need to Sign pane. Sign by clicking Place Signature, then click Send Signed Document to send your document to others securely via EchoSign.

But what if you need others to sign and approve your document, and track the results?  Simply click the Get Others to Sign pane in Acrobat XI, then the Send for Signature.  This will securely upload your document to EchoSign and prompt you to enter the addresses for the additional signers.  If needed, you can drag and drop fields on the document for e-signatures, initials, contact information, company, title, or any other customized form field.  Click Send and your document is on its way.

The document recipient will receive an email from you (via the EchoSign service) with a link to the document and simple instructions on signing. Recipients don’t need anything but their browser to sign the document then send it back to you. They can review the document and sign instantly with a mouse, stylus, or by typing their name, even from their mobile device. Talk about easy!

Acrobat XI and EchoSign used together also makes it easy to route, complete and eSign forms. When creating a form in Acrobat XI, you can use the Convert to EchoSign Form option in the Form Editing panel to convert all of your fields to EchoSign aware fields. This means the form recipients will be able to fill your form and electronically sign it using EchoSign in their browser, saving additional steps and time.

Additionally, making these fields EchoSign-aware allows recipients to pre-fill saved information automatically from EchoSign, like their name and title. The EchoSign form fields in Acrobat have special field properties to determine the signers information that should be prefilled. Simply upload your form for distribution through EchoSign and recipients can easily and securely fill and sign forms, all electronically. Adobe Acrobat XI not only gives you a full array of signing capabilities, it now helps you get signatures and approvals much faster with full exposure into the signing process using EchoSign. Watch this video to see how you can sign documents in Acrobat and then upload to EchoSign for signing by others.

For information on the security updates see Security Bulletin APSB13-02 for details.
For detailed Release Notes, please see the Enterprise Toolkit.

A few highlights to be aware of:

New Updater Mode Added to Acrobat XI for Windows
The Adobe Acrobat XI for Windows updater now has a fully-automated mode. As a reminder, “fully-automated” mode will regularly check for important updates, download them to your machine, and install them automatically. When finished, you will be alerted via a small message in the system tray that your software has been updated. This method is the recommended best practice for keeping Adobe Acrobat up-to-date and more secure given the fact that it does not require user intervention.

Handling Flash in 10.1.5
As mentioned in Three Common Adobe Reader and Acrobat Security Questions, unknown Flash will now be rendered by the system Flash Player (NPAPI version), when using Adobe Reader and Acrobat 10.1.5. Note: This has already been done for Reader and Acrobat 11. As stated before, this means that Adobe Reader/Acrobat users will no longer have to update Adobe Reader/Acrobat each time we update the Flash Player. This is particularly beneficial to customers in managed environments, because fewer updates means a lower cost of ownership, while maintaining a vigilant security posture.

And as a reminder, support for Adobe Acrobat 9.x will end on June 26, 2013.

Steve Gottwals, Group Product Manager

Q: What is the Adobe Acrobat and Reader update schedule?

About three years ago, we moved to a quarterly update schedule for Adobe Reader and Acrobat. It was part of a major initiative to strengthen the security of our products. At the time, three-month update cycles seemed like the right cadence given the threat environment and the pace we were adding new mitigation capabilities into the products. Fast-forward three years, and technologies like Protected Mode in Adobe Reader and Protected View in Acrobat (sandboxes) have provided effective layers of defense, reducing the need for the ongoing quarterly cadence.

So, recently we announced a closer alignment with the Microsoft Patch Tuesday model. Instead of delivering updates on a quarterly schedule, we will provide Adobe Acrobat and Reader updates on the second Tuesday of any given month as needed throughout the year to best address customer requirements and keep all of our users safe. We will also continue to publish a prenotification on the Adobe Product Security Incident Response Team blog three business days before we release a security update, and we will continue to be flexible and respond “out-of-cycle” to urgent needs, such as a zero-day attack.

Q: How is Flash content being handled in Adobe Acrobat and Reader?

Starting with Adobe Reader and Acrobat 9.5.1, we have classified Flash content into two categories, “known” and “unknown.” Known Flash content has been authored by Adobe and ships with the product. For instance, Portfolio Navigators and user interface elements are classified as known Flash content. Unknown Flash content has been authored outside of Adobe and does not ship with the product. For example, Custom Portfolio Navigators and Flash content embedded into PDFs are considered unknown. With this classification scheme, we are able to selectively render Flash content with different Flash Players. In 9.5.1 and later, we render known Flash content with an internal component embedded inside of Adobe Reader and Acrobat, and let the system Flash Player (NPAPI version) render the unknown content.

Since an attack would leverage unknown, as opposed to known, Flash content, this means that Adobe Reader/Acrobat 9.x users will no longer have to update Adobe Reader/Acrobat each time we update the Flash Player. This is particularly beneficial to customers in managed environments, because fewer updates means a lower cost of ownership, while maintaining a vigilant security posture. Keeping in mind that there is no silver bullet when it comes to security, we do follow a defense-in-depth security strategy. Therefore, even though we run all Flash content inside the sandbox in Adobe Reader and Acrobat X, where we’ve had great success thwarting attacks, we’ll still implement this new handling of Flash content into those products in the future. We’ll let you know when that happens.

Q: Can you explain the new security ratings?

In the past, security ratings were based on the worst-case scenario of a vulnerability without taking into account the presence or likelihood of an exploit. For a bit of background, a vulnerability is a code defect that can potentially be leveraged by an exploit to attack a system. Imagine the exact same code defect in two products. One product has a known exploit, while the other product has extra layers of defense that thwart the exploit from working. If you only consider the vulnerability, the security rating would look the same. But, if you consider the presence (or lack) of a functioning exploit as part of the security rating, you’ll get a different answer, and a better understanding of the threat, which in turn, provides better guidance on how quickly you should deploy the update.

This has happened with the introduction of new security mitigation technologies, like Adobe Reader Protected Mode (sandbox protections), which has made vulnerabilities much more difficult to exploit. Therefore, we’ve taken the degree of difficulty for exploit creation and included it in our new update priority ratings. We feel that this is the best way to clearly communicate real-world risk associated with the vulnerabilities addressed in any given security update.

Steve Gottwals, Group Product Manager, Adobe Acrobat Solutions Security

With today’s release, the days of printing, signing and faxing back documents are truly numbered. We’ve tightened the integration between Adobe Reader and Adobe EchoSign eSignature service, so you and your customers can gain real-time visibility into the signature process and status of contracts – giving you greater assurance and control over the management of all signed documents. We’ve also streamlined the desktop experience and added features that give you more choice and greater functionality.

Thanks to Adobe Reader for mobile, you can electronically sign a document by simply drawing your signature with your finger on a touchscreen, making it easy to conduct business while on the go.  Additionally, you can connect to Adobe EchoSign to get others to sign documents electronically, letting you track and manage the status of documents online. And, because the signed contracts are archived in the cloud, you can easily retrieve documents from anywhere, at any time, via a web browser.

We didn’t stop there, though. Adobe Reader for mobile also adds new capabilities that let you interact with PDF documents directly from your iOS or Android devices, including annotation, comment and forms fill. And, of course, the highly intuitive user interface provides an efficient PDF viewing experience regardless of the device.

With Adobe Reader and EchoSign, we’re making it easy for anyone to send important contracts to customers so that they can quickly and easily sign and send them electronically – and get the deal done faster. Give Adobe Reader with EchoSign a test drive on your next deal.

Kevin M. Lynch, SVP and GM, Acrobat and Document Services, Adobe

Users can choose the Highlight, Strikethrough, or Underline annotation tools, and drag over any text to easily markup text

Users can electronically sign a document by hand-drawing their signature with their finger on a touchscreen

Users can connect to Adobe EchoSign to get others to sign documents electronically, enabling senders to track and manage the status of documents online and users to retrieve documents from anywhere, at any time, via a web browser • Rebecca Staley, Marketing Specialist for Adobe Acrobat Solutions, discusses the new eSignature enhancements to Adobe Reader for the desktop and mobile devices.

With the new update, when you open a PDF document to be signed with Adobe Reader, you will have the option to place a scanned copy of your signature into the document. What if you don’t have the ability to scan an image of your signature? Don’t worry; we have that covered too. Using Adobe EchoSign, you can sign a document yourself by using the “Only I Sign” feature, which gives you the option to either draw in your own signature using a mouse or simply type it in.

When you need to get signatures on a PDF document, simply open it in the new version of Adobe Reader and use the “Send for Signature” button. Your document will automatically be uploaded to Adobe EchoSign, initiating the workflow to get a document signed using Adobe EchoSign. Through the EchoSign UI, you can drag and drop fields on the document for not only e-signatures, but also initials, contact information, company, title, or any other customized form field, before sending the document for signature. You also can get status updates and track the progress of your signature process through the EchoSign UI.

Documents signed using Adobe EchoSign are protected by the Federal E-SIGN Act, which makes online electronic signatures in a commercial transaction equivalent to a written signature so both you and your client can rest assured that signed document is 100 percent legal.

There are many use cases for electronic signatures. Tell us how Adobe EchoSign helps you get the job done faster.

By Jason Lemkin, vice president of Web business services at Adobe 

Here are the highlights:

·         Reflow
As promised, Reflow is back! This is a great feature for reading PDFs on your phone, since it strips the formatting and turns the document into resizable, reflowed text that you can easily scroll through. You can turn this mode on in the View Modes menu, shown here:

·         Remember Last Read Position
One of the frequent comments we’ve seen is that people really want to be able to switch between documents and applications, and be able to return to the exact spot they were reading. Now Adobe Reader remembers your last position in the document for all recently-read documents, so you don’t need to!

·         Opening PDF Portfolio Contents and Attachments
For PDF Portfolios,  Adobe Reader has always allowed opening contents if they were in PDF format. Now it will open any content type that you can view on your phone or tablet.  And since attachments are pretty similar to Portfolios, we’ve also extended this to work for attachments. When you open a document with attachments, Adobe Reader will show a paperclip in the lower right corner of your document, like this:

Just tap the paperclip, and you’ll see a list of the attachments.

·         Bug Fixes
We fixed issues that had been present since the Android Ice Cream Sandwich. 

We’re constantly working to improve Adobe Reader for Phones and Tablets, and we have some great enhancements already underway for 2012 that I’m sure you’ll be excited to see.  We appreciate your ongoing feedback and support!

Dennis Griffin, Principal Product Manager