When you budget time this coming Patch Tuesday (March 10) don't forget to leave some in for the following day, March 11, when Adobe will grace us with the update to the latest 0-day vulnerability in Acrobat and their Reader program.

The exploits of this vulnerability don't appear to be widespread, but you have to assume they could explode any minute. After what eWEEK and others went through last month you have to assume that PDF exploits can have a huge impact long after they are patched.

And the potential damage from this vulnerability, which has come to be known as the JBIG2Decode exploit, is huge: Didier Stevens has demonstrated this bug executing through the Adobe Reader shell extension; all the user has to do is to open a folder (in thubmnail view) that contains a malicious PDF using the attack.

I've already hit on Adobe hard for an insufficiently aggressive approach to vulnerabilities in their own products. In fact, for the JBIG2Decode there isn't even an effective mitigation. All Adobe has recommended is that we disable Javascript, a solution that itself is unacceptable to many organizations because Javascript is used in PDFs for forms processing applications, and it's there because Adobe put it in there. But disabling Javascript doesn't even really block the vulnerability, just the known exploits of it.