I've seen reports of the attack vector being IE and Acrobat, Flash player and (IIRC) Windows XP. It doesn't matter what the actual product was, it only matters that people aren't patching well known vulnerabilities. The vector is not a particular program it is a lack of attention to detail when it comes to patches.