A critical security update for Adobe Acrobat Pro and Standard 9 on Mac OSX is only available over HTTP, and is unsigned code. Is there any out-of-band way to verify the download is authentically from Adobe?


You're right. If you go to Adobe's website the update is transferred over HTTP and not HTTPS, which give any hacker in the network to hijack your update file with a simple Man In The Middle Attack and inject his/her malicious file instead of the legitimate Adobe's update.

However if you go to the same page and instead of clicking the download now button you copy the link and add HTTPS as a prefix to it. The file will transferred securely over HTTPS.

here is the direct link: https://ardownload.adobe.com/pub/adobe/reader/mac/11.x/11.0.06/misc/AdbeRdrUpd11006.dmg

  • Alas, that site gives a browser warning, because it doesn't have an Adobe certificate - it has Akamai. That's better, perhaps I can trust the Adobe-Akamai relationship, but still a bit weak. I'm somewhat concerned because I've downloaded the update and done a Google search for its MD5 and SHA1 hex values - and there are no mentions of those strings anywhere.
    – gojomo
    May 12 '14 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.