Adobe Users Targeted in Zero-Day Attack, Emergency Patch Underway

Adobe has warned of a zero-day attack tarvgeting Windows users of Adobe Reader and Acrobat.
The vulnerability was found in four versions, Adobe wrote in a security advisory:Click Here!
Adobe Reader X (10.1.1) and earlier 10.x versions for Windows and MacintoshAdobe Reader 9.4.6 and earlier 9.x versions for Windows, Macintosh and UNIXAdobe Acrobat X (10.1.1) and earlier 10.x versions for Windows and MacintoshAdobe Acrobat 9.4.6 and earlier 9.x versions for Windows and Macintosh An emergency patch is underway for Adobe Reader and Acrobat versions 9.4.6 and earlier 9.x versions, and will be delivered no later than December 12.
The vulnerability was also detected in Adobe Reader X and Adobe Acrobat X versions 10.1.1 and earlier 10.x versions. However for these later versions you can just enable your "protected mode" to prevent execution of the exploit.
To use "protected mode" in Adobe Acrobat X, go to Edit >Preferences > Security (Enhanced) and make sure "Files from potentially unsafe locations" or "All files" with "Enable Enhanced Security" are checked. To turn on the protected mode in Adobe Reader X, go to Edit >Preferences >General and verify that "Enable Protected Mode at startup" is checked.
Adobe said it will fix the issue in these versions in its next quarterly security update scheduled for January 10, 2012. Adobe Reader for Android and Flash were not affected.
But be careful about how you update your software!
Separately, on Tuesday Sophos’ Graham Cluley reported a new email scam, purporting to come from Adobe, that contains the Zeus Trojan horse in an attached ZIP file.
“Each email is slightly different, incorporating different reference numbers in the subject line, attached filename and message body. But the samples seen so far by Sophos all carry malware in the file ‘Adobe Systems Software Critical Update Dec 2011.exe’ contained within the ZIP,” Cluley wrote in a blog post.
As Cluley notes, Adobe never sends software updates via email.