Users of Adobe's Acrobat and Reader programs have a full four weeks to fret over a critical flaw that's being exploited in the wild to install malware on vulnerable machines.
Adobe said on Wednesday it would issue an update that plugs the hole on January 12, the same day Microsoft is slated to release its next installment of security fixes. The announcement came as the exploit was added to the open-source Metasploit framework for penetration testers. If white hat hackers can replicate the attack, it stands to reason that black hats, who stand to profit much more, can't be far behind.
Brad Arkin, Adobe's director of product security and privacy, said here that his team considered issuing an out-of-cycle patch sooner. The team ultimately decided against that option because a fix wouldn't be ready for two to three weeks and would "negatively impact the timing" of the already scheduled January 12 update.
"The delay an out-of-cycle security update would force on the regularly scheduled quarterly release represents a significant negative," Arkin wrote. "Additionally, an informal poll we conducted indicated that most of the organizations we talked with were in favor of" waiting until January 12.