Adobe Product Security Incident Response Team (PSIRT) Blog

Welcome to the Adobe Product Security Incident Response Team (PSIRT) blog. We’re planning to use this space to bring you security-related information about Adobe products. We’ll augment the information already included in our Security Bulletins and Security Advisories, as well as cover topics that may not fit into the Security Bulletin format.
For starters, we thought we’d give you some information on how our overall Incident Response process works, and specifically why (and how) the ‘Acknowledgments’ section appears in our Security Bulletins. Security researchers provide a valuable service to the community and Adobe believes their contributions should be acknowledged. That is why, if you’ve read an Adobe Security Bulletin, you may have noticed our acknowledgment section. Adobe appreciates the cooperation of third-party security researchers who adhere to the unwritten rule of allowing software vendors like Adobe time to provide potentially vulnerable customers with a fix or workaround before the researcher releases details of the vulnerability publicly.
The Adobe PSIRT is responsible for monitoring and responding to reports of potential vulnerabilities in Adobe products. The preferred method for alerting Adobe about potential security vulnerabilities is by contacting the PSIRT directly. The Adobe Security Report Form mailbox at www.adobe.com/misc/securityform.html is monitored by the PSIRT and can be used to provide details about an issue. The Adobe PSIRT can also be contacted directly at PSIRT@adobe.com.
Adobe takes the responsibility of securing our products very seriously. When security researchers uncover a potential vulnerability in one of our products that could expose organizations to security risk, the PSIRT coordinates with representatives from the product engineering team to identify an appropriate remediation. This will often include a patch or a simple workaround. Since releasing information about a potential vulnerability while a fix is still in development could expose consumers to risk, Adobe tightly controls information about the issue until a remediation is available.
Once a solution is available, we notify our customers about the potential security vulnerability by posting an Adobe Product Security Bulletin or Adobe Product Security Advisory on the Adobe website at
http://www.adobe.com/support/security
Adobe also provides a free notification service that distributes information about security advisories and bulletins at http://www.adobe.com/cfusion/entitlement/index.cfm?e=szalert