Adobe has acknowledged that some users are vulnerable to attack after downloading an outdated version of Reader from its Web site, and said it is now reevaluating how it updates the popular PDF reader.

Yesterday, Brad Arkin, Adobe's director for product security and privacy, responded to claims by Danish security vendor Secunia that the currently-available version of Reader contains numerous bugs, and that Adobe's update process can leave users vulnerable for days or even weeks.

"We do single-dot releases, such as [Reader] 9.1, as full installers," explained Arkin, referring to the version Adobe released in mid-March to plug several holes, including one that had been exploited by hackers since early January. "The double-dot releases, like 9.1.1 and 9.1.2, those are for patches only and work only with a full-installed version in place."

The single-dot releases, such as Reader 9.1, must meet a different quality level for testing than the patch releases. Doing it that way will "get security fixes faster to users," Arkin said. "That helps keep users up-to-date."

Patch-only updates are common in software, but the problem with Adobe's practice is that it continues to provide an out-of-date edition that many times isn't updated with the latest patches, argued Secunia on Monday. Adobe has issued two security updates since Reader 9.1's debut. The first, released May 12, patched a "zero-day" bug in Reader, while the second, issued June 9, fixed 13 or more flaws.

"Adobe does have the Adobe Updater, which will eventually update Reader to the patched versions," said Mikkel Winther, the manager of Secunia's PSI partner program yesterday. "But sometimes it takes days or weeks for the updater to come up."

By default Adobe's updater pings the company server once a week.

Adobe's Arkin admitted that the updater doesn't always work as it's supposed to. "The intended behavior of the updater is that when you launch Reader for the first time, it will check if there are any updates available," he said. "That's its intended behavior, but there are a lot of [PC] configuration factors that might lead to different behavior."

Arkin confirmed that a first-launch of Reader sometimes fails to trigger Adobe's updater on PCs in its own labs. The updater failed to appear after launching Reader 9.1 for the first time on three different Windows PCs that Computerworld tested.

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.