Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Adobe Confirms Unpatched PDF Backdoor

Posted by CmdrTaco on Mon Oct 08, 2007 09:29 AM
from the machines-wide-open dept.
Security
50Mat writes "Adobe has fessed up to a dangerous code execution vulnerability affecting software programs installed on millions of Windows machines. The flaw, publicly disclosed more than three weeks ago, could allow hackers to use rigged PDF files to take control of Window XP computers with Internet Explorer 7 installed. It affects Adobe Reader, Adobe Acrobat Standard, Professional and Elements and Adobe Acrobat 3D."
+ -
story

Related Stories

Submission: Adobe Confirms Unpatched PDF Backdoor by Anonymous Coward
[+] Critical Vulnerability In Adobe Reader 160 comments
An anonymous reader writes "Core Security Technologies issued an advisory disclosing a vulnerability that could affect millions using Adobe's Reader PDF file viewing software. Engineers from CoreLabs determined that Adobe Reader could be exploited to gain access to vulnerable systems via the use of a specially crafted PDF file with malicious JavaScript content. Successful exploitation of the vulnerability requires that users open a maliciously crafted PDF file, thereby allowing attackers to gain access to vulnerable systems and assume the privileges of a user running Acrobat Reader."
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Adobe Confirms Unpatched PDF Backdoor 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • Is it really an Adobe vulnerability? Seems more like it's an IE vulnerability that has been blame-shifted to whoever writes the plugins that might expose it for what it is.

    • Re:If it's only a problem on XP (Score:5, Insightful)

      by JoelKatz (46478) on Monday October 08 2007, @09:58AM (#20898941)
      From what I understand, and there isn't much in the way of technical details available, this is not an IE flaw. IE, correctly, doesn't assume that a URI is invalid just because it looks odd. This is correct, because there is no way IE can know if an URI for another protocol is valid or invalid. It is the responsibility of the target program to sanitize its input, knowing full well that it comes from an untrusted source.
      • From what I understand, and there isn't much in the way of technical details available, this is not an IE flaw.

        Secunia [secunia.com] disagrees with you.

        What's disgraceful about this is that it's an exploit that's been known since April at least, and neither Microsoft nor Adobe have patched it.

        • Well, I wonder why it's not a Vista issue. Is it because you get a UAC prompt before opening the stuff, or something else? (Yeah, I'm being ignorant right now.) The main point is that it's possible to register URI handlers in many ways. IF you choose to do it on the command line, you need to be extremely careful. As the GP said, there is no way to tell that the URL is really invalid. What could be done would be to specify an escpaing scheme to be used, but that's "only" a design error, not a bug, and anyon
      • Then whose fault is it that so many applications have had security issues lately due to how IE passes arguments to applications when launched? Is it a shitty API, or are these programmers just incompetent or ignorant of how to correctly do things?
    • It is an Adobe vulnerability if, after saving said PDF and opening it, you get infected.

      Has this been confirmed?

  • In a pre-patch advisory, Adobe offered a complicated (and unsupported) workaround for its customers
    So they want me to do what with my what? Isn't that like your mechanic telling you to do something but "if they ask, [they] didn't tell you"
  • Is that the same backdoor vulnerability as this one [michaeldaw.org]?

    To be honest, though, the subject sounds a lot like joke fodder [wikipedia.org]....

  • What About Foxit? (Score:5, Interesting)

    by Lagged2Death (31596) on Monday October 08 2007, @09:43AM (#20898771)
    I found Adobe Reader so slow, bloated, and annoying that I switched to Foxit Reader [foxitsoftware.com], which is much smaller and faster. Can anyone say if the vulnerability applies to Foxit as well?

  • plus about running into this on Vista (Score:5, Informative)

    by dioscaido (541037) on Monday October 08 2007, @09:44AM (#20898795)
    If it's also vulnerable on IE7 + Vista, luckily IE7 runs with such limited privileges that the code execution won't be able to do anything other than writing to the internet temp folder. That is, if you haven't turned off UAC.

    • If it's also vulnerable on IE7 + Vista, luckily IE7 runs with such limited privileges that the code execution won't be able to do anything other than writing to the internet temp folder. That is, if you haven't turned off UAC.
      get your free ringtones/[other garbage appealing to the less technically inclined] here!!!! and if you see a UAC window, just click ok to download!

  • Not a backdoor (Score:5, Informative)

    by Anonymous Coward on Monday October 08 2007, @09:44AM (#20898799)
    From the information available, this is just yet another security vulnerability.

    A backdoor is an intentional feature that one puts so that they can take over you computer.
  • URI and MIME type handling in both Windows and OSX is profoundly broken. It's second only to ActiveX in the opportunity for exploits... the basic problem is that when apps register handlers for local use (eg, 'help:' or '.chm') they are available to untrusted content by default. The fix is to have separate registries or separate flags that allow applications to explicitly register as handlers for internal use, or for use on untrusted documents.

    • Re:Microsoft shares the blame, Apple blindly copie (Score:4, Interesting)

      by jonwil (467024) on Monday October 08 2007, @10:23AM (#20899265)
      Something else that IE (as of last time I looked anyway) and possibly other browsers get wrong is that they try to "guess" the content of the file instead of trusting that what the web server says the file is, the file actually is. If the web server says it is text/plain, it should be rendered as plain text even if it may happen to look like HTML. If the web server says it is image/gif, it should be fed to the gif image decoder.
      RFC 2161 (HTTP 1.1) section 7.2.1 clearly says that it is ok for a client to use the filename or content of a file to identify what file type it is (and therefore what to do with it) if and ONLY IF the server does not provide a Content-Type header.
      There have actually been security flaws in the past (and may still be even now) caused because different parts of IE have a different idea of what type the file is (in particular whether the file is executable or not)

      Then again, considering how many other standards Intercrap Exploder doesn't correctly follow (RFCs and otherwise), its hardly surprising that IE doesn't get this right.

      I do wonder if Gecko gets it right (and treats the Content-Type header as gospel) or if violates the RFC too.

        • Re: (Score:3, Interesting)

          by Fweeky (41046)
          Grr, that link should be opera:config#Trust%20Server%20Types -- Slashdot ate my #
  • a Limited User account on XP are you vulnerable to this?
  • To reduce the horrendous bloat of Acrobat Reader?

    If only Adobe hadn't purchased Macromedia....FlashPaper had such promise...

  • Sklyarov? (Score:5, Funny)

    by Speare (84249) on Monday October 08 2007, @09:57AM (#20898921) Homepage

    The flaw, publicly disclosed more than three weeks ago, could allow hackers to use rigged PDF files to take control of Window XP computers with Internet Explorer 7 installed.

    Did Adobe ask the feds to lock up the person who publicly disclose this flaw? Or do they just save that treatment for the publication of flaws in eBook products that blind people can't use in Russia?

  • Just in time for the forced update from MS then? Perfect.
  • All I do is read pdf's.

    Just like Openoffice is immune to Word virus's--- is there a recommended non-adobe pdf reader folks would recommend?

    I'm getting tired of the "Please upgrade to version 7" warnings anyway.
  • I always disable javascript and open external links in the PDF reader. Is is enough protection? Or am I still vulnerable? Is it possible to write a NoScript like extension to acroreader?
    • you mean you didn't set noscript to block other plugins too? or did you mean an update for noscript much like the one that protects against that cross site scripting mess?
      • NoScript runs inside FireFox. I am thinking of a way a third party could write code and give it to me and that runs inside acroreader and block it from doing things I don't want it to do. In fact I would like some kind of code that will sandbox any application given to it. Something like "sandbox acroreader" should run acroreader and allow it to make all kinds of calls to the registry and disk etc etc. But none of these commands get past the sandbox environment. When I close I can examine all the changes ac
  • the site is slashdotted. Here [wikipedia.org] is the PDF'ed version of the article.
  • Note to all saying that there's no difference between Vista and XP:

    The official Adobe advisory [adobe.com] states: "Vista users are not affected".

    Now let the downplay begin.

    • Re: (Score:2, Funny)

      by Anonymous Coward
      That's because no ones figured out how to install Acrobat on Vista yet.

  • Control me (Score:4, Funny)

    by suv4x4 (956391) on Monday October 08 2007, @12:36PM (#20901049)
    The irony of this page [bayimg.com] (click for 100% scale) is astounding.

    I had to snap a shot before Adobe pulls their ad.
    • The browser should be secure by itself but when a plug-in is installed by the user (like Adobe Acrobat Reader) that plug-in can execute code and do pretty much what it what... so I would not blame IE7 for that. But I'm still happy to never have upgrade to IE7... yet.
    • You keep using that word, I do not think it means what you think it means.

      • Re: (Score:2, Informative)

        by nine-times (778537)

        Cheaper? Foxit Reader for Windows is listed as $39.00 [foxitsoftware.com].

        Adobe Acrobat Reader is free. How is that cheaper? Am I missing something?

        • in addition to the other users comment, you can download and use foxit for free, legally, from thier site. They pay version probably has special support or some other bonus.
        • Am I missing something?

          Yes, the price is for the "Pro" version, which includes: Annotation, Text viewer and text converter, form filler, etc. etc. etc.

          The free version, if you're only reading and printing PDF's, should suffice.

          • Re:solution (Score:5, Informative)

            by Victor Antolini (725710) on Monday October 08 2007, @10:07AM (#20899049) Homepage
            Oh, I missed to point out what you missed. From http://www.foxitsoftware.com/pdf/rd_intro.php [foxitsoftware.com]

            Foxit Reader itself is free. As to add-ons, the critical add-ons are free while advanced add-ons are non-free. For example, you can use the following functions for free:

            * View or print PDF document
            * Basic PDF form operations i.e. filling out PDF forms and printing them out
            * Advanced PDF form operations, such as saving filled-out forms and import/export forms, free for personal usage only
            * View PDF as text
            * Critical add-ons, such as UI language package, JPEG2000/JBIG decoder, CJK package, GDI+ for early Windows version, etc

            The followings are several examples of non-free, advanced add-ons:

            * Foxit Reader Pro Pack is not free. It includes the following functions:
            o Annotation
            o Text viewer and text converter
            o Form filler
            o Spell checker
            o Advanced editing tools, including loupe tool, measure tools, image tool, file attachment tool, link tools, annotation selection tool, and more

            Actually without Pro Pack, you are still able to annotate a PDF document and print it out. However when you save the annotated document, it will be stamped with an evaluation mark on the top-right corner of the annotated pages. If you purchase a Pro Pack add-on, then there will be no evaluation mark.
            • This is similar to Acrobat itself - the Adobe Reader (formerly Acrobat Reader) is free, but if you want to write or annotate, you need to buy a license. I assume Foxit has to pay Adobe a royalty to create a writer, as even though Acrobat itself is an Open standard. Adobe has a lot of patents on both Acrobat itself and the underlying renderer, which is a subset of PostScript.

              Note that the Ghostscript program allows conversion (writing) of a file format such as Word into Acrobat by printing to an Acrobat fi

    • Welcome... (Score:5, Funny)

      by sakdoctor (1087155) on Monday October 08 2007, @10:07AM (#20899061)
      ...to hyphen hell! The rules - of style that apply to dashes - and hyphens - have evolved to support ease of reading in complex constructions; editors - often accept deviations - from them that will support, rather than --- hinder, ease of reading.

    • Can we finally just agree to stop using native code with the full privileges of the user and no sandbox for everyday low-volume information exchange?
      Define "low volume" and we'll talk. Specifically, where should the transition between code in, say, the Python virtual machine and native C++ code occur?

    • Re: (Score:3, Informative)

      by nurb432 (527695)
      That also isnt 100% compliant.

      While i use it all the time since it is smaller and ligher ( acrobat reader is free too btw, so that isnt a good selling point ), i have noticed that somethings do NOT render properly.

      Have they fixed the weblink bug yet?

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.