Slashdot Log In
Critical Vulnerability In Adobe Reader
Posted by
timothy
on Wed Nov 05, 2008 04:32 PM
from the see-attachment dept.
from the see-attachment dept.
An anonymous reader writes "Core Security Technologies issued an advisory disclosing a vulnerability that could affect millions using Adobe's Reader PDF file viewing software. Engineers from CoreLabs determined that Adobe Reader could be exploited to gain access to vulnerable systems via the use of a specially crafted PDF file with malicious JavaScript content. Successful exploitation of the vulnerability requires that users open a maliciously crafted PDF file, thereby allowing attackers to gain access to vulnerable systems and assume the privileges of a user running Acrobat Reader."
Related Stories
[+]
Adobe Confirms Unpatched PDF Backdoor 170 comments
50Mat writes "Adobe has fessed up to a dangerous code execution vulnerability affecting software programs installed on millions of Windows machines. The flaw, publicly disclosed more than three weeks ago, could allow hackers to use rigged PDF files to take control of Window XP computers with Internet Explorer 7 installed. It affects Adobe Reader, Adobe Acrobat Standard, Professional and Elements and Adobe Acrobat 3D."
[+]
PDF Exploits On the Rise 183 comments
An anonymous reader writes "According to the TrustedSource Blog, malware authors increasingly target PDF files as an infection vector. Keep your browser plugins updated. From the article: 'The Portable Document Format (PDF) is one of the file formats of choice commonly used in today's enterprises, since it's widely deployed across different operating systems. But on a down-side this format has also known vulnerabilites which are exploited in the wild. Secure Computing's Anti-Malware Research Labs spotted a new and yet unknown exploit toolkit which exclusively targets Adobe's PDF format.'"
Submission: Critical Vulnerability in Adobe Reader by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
For the uninformed: (Score:5, Informative)
Foxit [foxitsoftware.com] FTW
Re:For the uninformed: (Score:5, Informative)
While investigating the feasibility of exploiting a vulnerability previously disclosed in Foxit Reader (CVE-2008-1104), a CoreLabs researcher found that Adobe Reader was affected by the same bug.
Foxit users: don't panic. Though Foxit Reader v2.3 build 2825 is vulnerable, 2.3 builds 2912 and later are patched. Build 3309 is the current version available for download.
...with the privileges of a user running the Adobe Reader application.
Which strongly implies that those affected will be Windows users with Administrator access.
Parent
Re:For the uninformed: (Score:5, Insightful)
...with the privileges of a user running the Adobe Reader application.
Which strongly implies that those affected will be Windows users with Administrator access.
It seems fair to worry even if you aren't running as admin. If a trojan PDF can run arbitrary code with privileges of the user running Adobe Reader, that's still enough to screw with that user's documents even if the user isn't an admin.
Parent
Re:For the uninformed: (Score:4, Informative)
if you rtfa, you would note that the current build of adobe reader isn't vulnerable either.
Parent
Re:For the uninformed: (Score:5, Informative)
Another option for PDF reading on Windows is Sumatra PDF [kowalczyk.info] (if you prefer open-source).
Parent
Re: (Score:3, Informative)
I knew some guy would chime in recommending Foxit, but I'm surprised and glad to see a recommendation for Sumatra.
Foxit is suffering from its own feature-creep and bloat-up issues (on a much smaller scale than Adobe's software, but still), so Sumatra is really what I _think_ everyone who chimes in with "Foxit" really means to recommend. It accurately renders PDFs. THAT'S IT.
Re: (Score:2, Informative)
Re:For the uninformed: (Score:5, Funny)
Parent
Re:For the uninformed: (Score:5, Informative)
That might work on some or most files, but there still is no replacement for Acrobat.
True, but we're getting closer. OpenOffice 3 now has a PDF Import [openoffice.org] extension, and of course for Windows there's PDFCreator [sourceforge.net] (Gnome/KDE and OS X natively support printing to PDF).
Parent
Re:For the uninformed: (Score:5, Funny)
I know you're trying to look smart but export and import aren't the same thing.
Parent
Re: (Score:3, Informative)
Re:For the uninformed: (Score:5, Insightful)
Perhaps, but you can have multiple PDF readers installed. And in terms of security, it's usually best to use the simplest application that will work.
So basically you could use FoxIt or Sumatra PDF to open most PDFs. And then for the rare one that uses some advanced stuff, you can fire up Acrobat. The fact is that most of the stuff that Acrobat supports that other PDF readers don't involves some kind of scripting. And really you shouldn't be running any scripts (even those that are, in principle, sandboxed) unless you have reason to trust them.
So a sensible strategy would seem to be that you open 99% of PDFs with a simpler reader, and only use Acrobat on the few that really need it, and only if the source of the PDF is trustworthy in your estimation.
(Yeah, I know... it's a bit of a pain to have multiple programs that do the same thing. In principle you "shouldn't have to" in the sense that your PDF reader should be secure. But in reality it seems like a reasonable precaution.)
Parent
Re:For the uninformed: (Score:4, Insightful)
I think it makes good sense to have a different app depending on what you need done. For instance, reading articles in PDF in Preview or Acrobat is a pain, and I'll use Skim.app [sourceforge.net] for those.
Parent
Re:For the uninformed: (Score:4, Insightful)
The real solution is to open 100% of PDFs in a simpler reader, and refuse to tolerate PDFs that require scripting.
Really, there's no good reason for a document viewer to have the bloat of Acrobat, and we shouldn't encourage Adobe by doing what they want.
Parent
Re:Scripting is useful, but.... (Score:4, Insightful)
No javascript in pdf is an excellent solution. It's a DOCUMENT, not a video game or word processor or anything else. You don't get javascript on a paper printout; you don't need javascript in the electronic version of a paper printout.
Few people disable javascript in their browsers.
I do. Most javascript in web pages is useless and needless and a waste of computer cycles. If you want to calculate something, do it on YOUR SEVER and send me the result.
It's a crutch used by poor web designers to add glitz to content-less pages.
I caught a major cell-phone company using javascript to provide log-in security for their account access web pages. Since I had javascript turned off, I had access to anyone's account I wanted. I told them what I was doing and they didn't believe it, until I started telling the account manager I was talking to what his minute balance and last payment was. THEN he got interested.
Much better that pdf authors spend the time properly identifying their documents with title and author information. I have US Government produced pdfs where the "title" of the document is "Microsoft preview -- C:\some\file\name\that\is\meaningless.doc" and the author is even stupider. Leave out the fancy crap until you can properly identify your documents, ok?
You need evidence that javascript on web pages is useless? Try Yahoo. I go to my Yahoo mail page and a big, time-wasting page tells me that I have javascript turned off, click here for the OLD version of mail -- which is exactly where I was trying to get to in the first place, damn it!
And get off my lawn...
Parent
Re:For the uninformed: there is an "off" switch (Score:3, Interesting)
Why complicate your life with multiple readers....sure, if you really want to -- especially if you _like_ their interface better, but for the supposed sake of security? On a feature that should be off most of the time anyway? With more readers on your system, you have more 'active code' that your computer is regularly exposed to -- isn't there a risk with an increased code base? Sure, Adobe Reader would be more likely to be attacked than other pdf readers, but it's probably 'tested' by a few more users e
Re:For the uninformed: (Score:4, Informative)
Huh? I create PDFs all the time, and don't own a copy of Acrobat. I use pdftex and inkscape, but there's scads of other software that can do it, e.g., Scribus if you want GUI desktop publishing. This is all on linux, but there's tons of PDF-creating software on Windows as well.
Parent
Re:For the uninformed: (Score:5, Informative)
there's tons of PDF-creating software on Windows as well.
PDFCreator from sourceforge:
http://sourceforge.net/projects/pdfcreator/ [sourceforge.net]
It's a Windows printer that prints out your documents as PDFs.
It's that easy.
Parent
Re: (Score:2)
That might work on some or most files, but there still is no replacement for Acrobat.
Depends on what you need Acrobat for...
If all you want to do is view a PDF, you certainly don't need Adobe Reader (which is what the story talks about). There are plenty of perfectly good alternatives out there, and Foxit is one of them.
If you want to create a PDF, you frequently don't actually need Adobe. We've got tons of clients who basically just want to email a simple word/text/whatever document to someone with relative certainty that they'll be able to open it, view it, and print it - but not make c
Re: (Score:2)
That might work on some or most files, but there still is no replacement for Acrobat.
I have had one PDF file so far this year that failed to open in KPDF - and I have not tested if that opens in Acrobat either.
I have never used Foxit, but there are certainly perfectly good, reliable, PDF readers other than Acrobat.
This may not be true if you need a particular feature that is only implemented by Acrobat, for most people the alternatives are as good or better.
Structural Issues (Score:2, Funny)
Critical Vulnerability In Adobe
You see, if you mix too much water into the mixture before it hardens, it is brittle and your dwelling will collapse on you ...
Re: (Score:2)
In terms of software architecture, it's like mixing of too much Turing completeness into this particular DSL.
Symptoms you've been attacked (Score:3, Insightful)
Adobe Reader is very slow to load and freezes your browser. Yes, it's very difficult to tell.
Single-purpose tools are good (Score:5, Insightful)
Does Adobe Reader come with a "safe mode" with just plain old PDF enabled?
If not, it should.
Re:Single-purpose tools are good (Score:5, Insightful)
Your remark leads to the general question: what business does a document viewer have trying to execute embedded Javascript scripts? a PDF file is essentially a PostScript file, so its content is supposed to be interpreted as a page description and nothing more.
This is reminiscent of Microsoft's "executable" .DOC files that was used to spread viruses around years ago. This is what you get when you try to make a tool too clever for its own good.
Parent
Re:Single-purpose tools are good (Score:4, Informative)
Parent
Re: (Score:3, Informative)
JS in PDFs is silly IMO, but I have to point out that PS (but not PDF) is a Turing-complete language.
http://www.tinaja.com/post01.asp [tinaja.com]
Re:Single-purpose tools are good (Score:5, Interesting)
Sure, JavaScript is pointless in a PDF viewer and should be disabled, but it is worth noting that PostScript itself is a programming language. It has conditionals, functions, loops, etc. I myslef once hand-coded a PostScript program to draw a high-res graph of a particular function for a class back in college. This 1K file basically owned the imagesetter in the print lab for about 45 minutes while it rendered at 1200 dpi.
If I recall correctly, there were even a couple of postscript exploits back in the 1990s that could "brick" Apple LaserWrtiers.
Parent
Re: (Score:3, Informative)
Postscript is a stack based programming language. PDF was afaik originally designed to be a simpler format for just describing page layout. But then they've extended it to be able to include javascript for programming and embedding videos, flash and all sorts of stuff (sounds like HTML...).
http://en.wikipedia.org/wiki/PostScript [wikipedia.org]
Re: (Score:2)
Does Adobe Reader come with a "safe mode" with just plain old PDF enabled?
If not, it should.
Agreed. And the same goes for every other application primarily designed to read documents (images, media files, whatever).
On the one hand, I find some of the functionality that is being embedded in various document types useful, but on the other hand I find it ridiculous that data can attack us.
Re: (Score:3, Interesting)
Re: (Score:2)
Yes. Because we should soon expect the renderer installer alone to consume an entire 4 GB DVD. Adobe Acrobat is the pinnacle of bloatware. No wonder vulnerabilities like these are discovered. It must be easy to poke holes in the 17 gajillion lines of code it takes Adobe to render text.
Re:Single-purpose tools are good (Score:5, Informative)
To disable js, go to Edit, Preferences, JavaScript, and uncheck "Enable Acrobat JavaScript".
Even if the js-related security bugs are fixed, it's still a privacy issue, because js in a pdf file can be used to track who's reading a particular document.
Personally, when I see that a piece of software has a long history of security problems, I take that as my cue to remove it from my system. I don't really care that they keep fixing the bugs. The fact that it has this history demonstrates that the software wasn't written with the correct attention to security, and it's likely to have more such problems in the future.
If you're running Linux, xpdf starts up extremely fast, and that's why I use it as my pdf plugin in Firefox. If you want something a little more modern, try evince.
People have posted saying that on Windows, you should switch to Foxit, but the article says that the security flaw was found first in Foxit, and only later in Adobe Reader. I actually tried to get the science division at the community college where I teach to switch to putting Foxit on machines in the student labs as the default pdf plugin. However, when the faculty were testing it, they found that it was not correctly displaying some of the pdfs they were using.
Parent
Re: (Score:2)
And it should also be the default mode, IMO.
But I guess I never got the memo that explained why Acrobat Reader was doing anything more than reading plain/static PDFs in the first place. Didn't they do something in new versions to allow Flash and movies, or something?
The only reason I use PDFs is when I want to make a document with a very controlled layout, both in print and on a display, without any expectation of editing. Honestly I'm willing to pay money to Adobe to get Acrobat if it's going to help m
Which again... (Score:5, Insightful)
...begs the question "Why Does Adobe Reader Need Javascript"??
Re:Which again... (Score:5, Informative)
Parent
Re:Which again... (Score:5, Insightful)
You are part of the problem.
Parent
Re:An alternative? (Score:4, Informative)
Web page?
Parent
Re: (Score:3, Interesting)
I've written scripts for Adobe Acrobat Professional to interleave PDFs of scans from my single-duplex, automatic document feeder scanner. Can you believe that there are companies out there that charge $100 or so to do the same task with a plugin? Took me 15 min to write it in JavaScript myself.
As far as Reader though, I've seen some web-fill state tax forms that use Javascript for field validation.
Re:Which again... (Score:5, Informative)
It raises the question, godsdamnit. Here's what "begging the question" actually means:
http://en.wikipedia.org/wiki/Begging_the_question [wikipedia.org]
Parent
Re: (Score:3, Insightful)
It raises the question, godsdamnit. Here's what "begging the question" actually means:
Originally you're correct. The common idiom has changed to reflect a more intuitive meaning. Language changes over time. YOU are the one failing to deal with it.
Re: (Score:3, Insightful)
From your link:
"More recently, to beg the question has been used by some to mean "to raise the question", or "the question really ought to be addressed". [7] An example of such a use would be, "This year's budget deficit is half a trillion dollars. This begs the question: how are we ever going to balance the budget?" Although proponents of the traditional meaning will criticize this formally incorrect usage, it has nonetheless come into widespread use and in informal contexts may actually be the more common
You can have it, hackers (Score:5, Funny)
Successful exploitation of the vulnerability requires that users open a maliciously crafted PDF file, thereby allowing attackers to gain access to vulnerable systems and assume the privileges of a user running Acrobat Reader.
The main privileges being the privilege of waiting thirty seconds to view text, followed closely by the privilege of a crashed web browser.
Re: (Score:2)
hehe, people use to say that about the overflow in the default php install for apache. "oh, you can only get access to the 'anonymous' account on the web server". There's always a dozen different local exploits you can use to escalate from these accounts. And that's on a platform which actually takes security seriously.
Out of curiosity... (Score:2)
Re: (Score:3)
I guess after they took Turing-completeness out of PS to make PDF, they wished they hadn't, and somehow thought JS was better than PS.
Yep. (Score:2)
As usual, take precautions to ensure you're not automatically opening PDFs in your browser - Save by default instead, so you can scan it and actually make the decision to open it yourself.
For Firefox users:
Tools->Options->Applications. Change actions for PDFs to Save.
How soon we forget best practices (Score:3, Informative)
Is this hole cross platform compatible? (Score:3, Insightful)
Adobe is one of the best when it comes to cross-platform compatibility and the hole is based on Javascript...
And yes, I did RTFA.
Miserable Retards (Score:5, Insightful)
When I install a new piece of software, the first place I go is to the preferences panel to see if there are any stupid/broken settings that need to be fixed (or, too often, fixed again after an upgrade). I can't remember which version it originally showed up in, but when I saw the checkbox for JavaScript in Acrobat Reader, my jaw hit the floor.
"Are you people fscking morons? Did you learn nothing from the exploits and problems caused by JavaScript in Web browsers? Hell, forget Web browsers; Microsoft Word became a virus/trojan platform because the Special-Needs Children who apparently design all their software thought it would be tEh k00l to embed macros in what is fundamentally a static document."
Every time some would-be clever person adds a macro language or other executable logic to a document format, the result is "unexpected" worms, viruses, and security breaches. Every God-damned time.
This is not an honest mistake. This is negligent engineering, and someone needs to lose a lot of money over it before the lesson sinks in.
Schwab