Apple said on Friday that it is issuing an OS X patch that will remove DigiNotar certificates “from the list of trusted root certificates, from the list of extended validation certificate authorities, and by configuring default system trust settings so that DigiNotar's certificates, including those issued by other authorities, are not trusted.”
DigiNotar is the Dutch certificate authority that issued more than 500 bogus digital certificates in the name of major web properties, as well as intelligence services, such as the CIA, MI6, and Mossad. Microsoft and Mozilla have already taken actions to ban DigiNotar certificates.
On Thursday, Adobe said that it is the process of removing DigiNotar certificates from its Adobe Approved Trust List (AATL), which enables users to create digital signatures for documents opened in Acrobat 9 and Reader 9 and later versions.
“Essentially, both Acrobat and Reader have been programmed to reach out to a web page to periodically download a list of trusted ‘root’ digital certificates. Any digital signature created with a credential that can trace a relationship (‘chain’) back to the high-assurance, trustworthy certificates on this list is trusted by Acrobat and Reader 9 and later”, Adobe explained.
In addition, Adobe issued an advisory on its Sept. 13 security update. The company said it will be fixing critical security holes in all current versions of Reader and Acrobat for Windows and Mac.