Adobe is working on fixing a bug in Download Manager, the program Adobe uses to speed up downloads of its products.
According to security researcher Aviv Raff, the flaw could be misused by hackers to to force web users to install unwanted software on their computers.
Because of an undisclosed flaw in the way Download Manager works, the "attacker can force an automatic download and installation of any executable he desires", Raff said in a blog.
"So, if you go to Adobe's website to install a security update for Flash, you really expose yourself to a zero-day attack."
Adobe said it was working with Raff and the third-party developer of the Download Manager product to fix the issue.
Download Manager includes an executable program and an ActiveX control or Firefox extension file, depending on which browser is used.
However, it would be hard for a user to install unwanted software without realising it, because "the user has to accept a number of prompts before being taken through the installation process", said Adobe spokeswoman Wiebke Lips.
The Download Manager is different from Adobe's Update Manger, which is used to patch Adobe software.
Download Manager only runs on the computer when software is downloaded, and it removes itself on the next restart. So Raff's attack would only work before that restart removed the Download Manager software.
Still, he believes it is a serious security risk.
"This is the kind of scenario that's common when skilled, motivated attackers are going after select targets," Raff said.
Return to hosting news headlines
View Hosting News Archive