Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security IT

Adobe PDF Exploits In the Wild 150

Posted by CmdrTaco from the junkbusters-are-better-than-virus-scanners dept.
mambosauce writes "Brian Krebs, via the security fix blog is reporting that the recent PDF vulnerabilities which were patched only for Adobe Reader 8 and not 7 are being exploited via banner ads. As if there haven't been enough banner ad attacks this year now we have another one targeting one of the most popular applications in the world this weekend. At this rate there won't be many safe applications left to use."
This discussion has been archived. No new comments can be posted.

Adobe PDF Exploits In the Wild More

Adobe PDF Exploits In the Wild

Comments Filter:

  • Use a different PDF viewer instead (Score:5, Informative)

    by Anonymous Coward on Saturday February 09, 2008 @12:38PM (#22361204)
    That's what foxit and kpdf are for.

    • Re:Use a different PDF viewer instead (Score:5, Insightful)

      by ScrewMaster ( 602015 ) on Saturday February 09, 2008 @12:44PM (#22361260)
      No kidding. FoxitReader is a hell of an improvement over Adobe's crap, even if it isn't open source.

      • Re: (Score:1)

        by mikapc ( 664262 )
        I second that. Foxit is so much faster and less of a resource hog then adobe reader.

        • But Foxit doesn't work! (Score:5, Insightful)

          by Anonymous Brave Guy ( 457657 ) on Saturday February 09, 2008 @01:42PM (#22361676)

          Foxit is so much faster and less of a resource hog then adobe reader.

          It also doesn't work. For example, two-page documents generally start with page 1 on the right, yet in two-page mode Foxit insists on displaying pages 1 and 2 together, 3 and 4 together, etc. I discovered this when I tried it after seeing comments like the parent and GP posts, and also discovered that there have been bugs logged on this for eons but no-one seems to care about fixing it. The software was uninstalled from my PC within two minutes of installing it and filed under "beyond hope".

          One of these days, people on Slashdot will realise that something that is free/or more secure is still worthless if it doesn't actually do the job it's supposed to do.

          • the page layout (right vs left) is hardly a major issue when it concerns Foxit, a PDF -reader-. I can fully understand if you want it to work correctly for a PDF authoring app, so that it comes out the printer the way you see it on screen, but geeze.

            It's like calling ThunderBird "beyond hope" because the thunderbird team appear to be unwilling to fix the folder rename issue on the Windows platform (renaming "Test" to "test" will tell you that it already exists. durrr. https://bugzilla.mozilla.org/show_bug. [mozilla.org]
      • And if you need more OSS in your diet, there's SumatraPDF (http://blog.kowalczyk.info/software/sumatrapdf/ [kowalczyk.info])
      • I like Foxit and use it in place of Acrobat Reader, but there's one problem I have with it that makes me have to start up Acrobat Reader sometimes. Some types of PDFs like datasheets seem to cause the program to grind with what looks like completely rerendering the page every time it's scrolled. It gets hung up for a couple of seconds with every motion making it almost unusable for some documents but Acrobat Reader works perfectly with the same files. Anyone have some idea what this is about?

      • Re: (Score:2, Informative)

        by Futil3 ( 931900 )
        Sumatra PDF [kowalczyk.info] is a very speedy and free (GPLv2) reader for the Windows people. (no affiliation, just a happy user.)
      • Comment removed based on user account deletion
        • I haven't bothered with anything but foxit since the adobe reader became bloatware

          It's been around that long? The Acrobat Reader is a funny piece of software. The first 3 versions were complete crap. Then it got good for about two versions, then they turned it back into crap. That's the one thing I've found about a lot of commercial software... they can never leave well enough alone because they need to force the upgrade cycle, so even once you get a good version, it just as liable to get completely rui

    • Re: (Score:2)

      by iamacat ( 583406 )
      Yeah, Preview is pretty good too. Unlike Acrobat, it starts instantly without the annoying logo popping up for half a minute in the middle of the screen and blocking all the other applications.

    • Re: (Score:3, Informative)

      by FudRucker ( 866063 )
      in case anyone is interested kpdf is part of KDE's kde-graphics package...
    • Rather, both kpdf and acroread.

      The main reason I have acroread is because I can -- it's one less program people can whine about not having on Linux, and you never know when I'll run into something kpdf can't handle.

      But I also have it because it has one feature I dearly wish kpdf did: the ability to rotate the rendered PDF. Take a widescreen, clamshell laptop/notebook, turn it on its side, and let a page of a book fill the screen, and you have a pretty nice eBook reader.
      • But I also have it because it has one feature I dearly wish kpdf did: the ability to rotate the rendered PDF. Take a widescreen, clamshell laptop/notebook, turn it on its side, and let a page of a book fill the screen, and you have a pretty nice eBook reader.

        I did that for a while a few summers ago. Take a Project Gutenberg text file (or any text file), throw it into your favorite word processor/page layout program, choose a nice body font, give it some reasonable margins, stick page # footers in, then e
        • > Take a Project Gutenberg text file (or any text file), throw it into your favorite word
          > processor/page layout program, choose a nice body font, give it some reasonable margins,
          > stick page # footers in, then export it all out to a PDF. Fire up Acrobat Reader, set the
          > background color to a nice cream color, rotate the page 90 degrees, hit fullscreen...

          Seems like a lot of wasted effort. Why not just use xrandr to rotate the display?
          • I never did this with Gutenberg.

            In my case, because I didn't know about xrandr, originally did this on OS X, and I really only want to rotate that one book. I'd rather not have to rearrange the rest of my windows.

            And I didn't use the cursor, I used spacebar, I think. Nice, big target.

      • Re:I have both... (Score:4, Informative)

        by whoever57 ( 658626 ) on Saturday February 09, 2008 @02:25PM (#22362068) Journal

        But I also have it because it has one feature I dearly wish kpdf did: the ability to rotate the rendered PDF.
        Evince can do this.

      • Re: (Score:2)

        by xaxa ( 988988 )

        one feature I dearly wish kpdf did: the ability to rotate the rendered PDF.
        KGhostView will do this. I don't know why Kpdf won't.

  • Solution: (Score:3, Insightful)

    by CSMatt ( 1175471 ) on Saturday February 09, 2008 @12:39PM (#22361212)
    Don't use Adobe Reader.
  • And IE isn't already in this category?

  • "Safe" application? (Score:4, Insightful)

    by Chas ( 5144 ) on Saturday February 09, 2008 @12:45PM (#22361276) Homepage Journal
    [Windows User] WUZZAT?

    You have a multitude of applications, varying versions of operating systems, and scores of browser versions out there.

    Is it REALLY any surprise that there are security holes like this? The miracle is that there aren't MORE.

    Note: I'm NOT saying that these holes aren't a bad thing and shouldn't be patched. But this idiotic notion of a "safe" app just irks the shit outta me.

    The only "safe" app is one that has absoloutely no interaction with other programs or the user whatsoever. (IOW it don't exist.)

    • Applications would be secure if they didn't have to deal with people . . .

    • Re: (Score:2, Funny)

      by youthoftoday ( 975074 )
      If everyone did things in pure functional programming languages there would be no side-effects.
    • It is possible to write provably safe apps. As in, mathematical proofs.

      In fact, there is a company which specializes in writing damn-near absolutely safe, bug-free apps. They do it in about as much time as the competition writes buggy, insecure apps, because the lack of bugs in the first place means less of a debugging cycle. They charge about twice as much, because very few other companies provide that much quality.

      Can't remember their name now, though.
  • I recently received an email spam with a PDF (not the file.xxx.exe I normally see in such emails), I figured that was one of the exploit files.

    Some vague "Your Account" message from "Bank Trust" from some a 3rd party email with the Manual_Invoice.pdf attachment. 134k

    • Re:Got one phishing email attachment w/PDF (Score:5, Funny)

      by Anonymous Coward on Saturday February 09, 2008 @12:51PM (#22361316)
      Yeah, I got that one, too. Thing is, I don't remember opening an account with Bank Trust. I went to the website and tried logging in with all my various bank logins, and none of them worked. I think someone at Bank Trust really screwed up when they sent that message out. Morons.
      • Sorry for the inconvenience. We have fixed it now. The new method also requires your email address, SSN, and your ebay/payal IDs and passwords.

    • Re: (Score:2)

      by sqlrob ( 173498 )
      Possibly infected, possibly not. That's one of the tricks to get around spam filters.

  • Blocking Banner Ads (Score:4, Insightful)

    by AngelKurisu ( 1173447 ) on Saturday February 09, 2008 @12:50PM (#22361310) Homepage
    This is just another addition to the mounting list of reasons I block most banner ads. Why should I download something that could be dangerous, and adds no value to my browsing experience? I manually un-block certain sites I know to have decent levels of quality assurance in their ads (Penny Arcade, Slashdot, for example). I'd much rather directly micropay for content than be served completely worthless ads anyhow.

    • Re:Blocking Banner Ads (Score:5, Insightful)

      by calebt3 ( 1098475 ) on Saturday February 09, 2008 @01:23PM (#22361530)
      I have also unblocked ads for /., but it's kinda pointless because I won't allow doubleclick through NoScript. Why do we need animated ads?
    • If you would prefer to micropay for content, why don't you become a slashdot subscriber? It seems to me that a lot of people say they would want to micropay for content, but when faced with the amount of content they consume fear being nickel and dimed to death (or in this case penny-nickel and penny-dimed).

  • lynx (Score:4, Funny)

    by acidrain ( 35064 ) on Saturday February 09, 2008 @12:55PM (#22361350)

    At this rate there won't be many safe applications left to use.
    Good old lynx. Surfing the web in text-only since the beginning of internet time.

    • Re:lynx (Score:4, Informative)

      by McDutchie ( 151611 ) on Saturday February 09, 2008 @02:19PM (#22362004) Homepage

      Good old lynx. Surfing the web in text-only since the beginning of internet time.

      I know you were kidding, but it's still worth pointing out that Lynx is not necessarily safer than any other app [google.com].

    • Re: (Score:2)

      by arth1 ( 260657 )
      Lynx isn't text-only. It calls up other programs for parsing various content types. In true Unix style, it is a toolbox program, meant to interoperate with (call AND be called by) other programs.

      Nothing stops you from setting lynx to use Adobe Acrobat Reader for pdf files, just like you set Firefox to use Adobe Acrobat Reader for pdf files. No difference there, except that Acrobat Reader does the configuration of Firefox for you automatically. But if you're a lynx user, it would likely take you less tim
  • that I got from Acrobat 8 today and it downloaded really slow. Still it is good to know that it is being patched fairly quickly.

  • If only... (Score:5, Funny)

    by Darundal ( 891860 ) on Saturday February 09, 2008 @12:59PM (#22361372) Journal
    ...there were web browsers that allowed you to block certain types of code, or had extensions that would perform a similar function...

  • Yet Another Misleading Headline (Score:5, Informative)

    by dotancohen ( 1015143 ) on Saturday February 09, 2008 @01:01PM (#22361396) Homepage
    This is NOT "Adobe PDF Exploits In the Wild" but rather "Adobe Acrobat Reader Exploits In the Wild". The problem in is Reader, not in PDF. That's like calling Outlook scripting worms "email viruses". Oh, wait, blame the technology, not the software. Sorry, I forgot.
    • For Joe and Jane Sixpack, PDF=Acrobat, www=IE. Saying that other readers/browsers are safe is irrelevant for the majority of people.
  • Whatever some companies might want to imply, the solution will not be anything called Silverlight. It would be like replacing Photoshop, because of some vulnerability, with Excel...

  • At this rate there won't be many safe applications left to use.

    There are plenty of free software programs to use. The issue here has to do with proprietary software restrictions on user's freedoms to inspect, share, and modify programs. Just because Adobe is unwilling to modify older versions of their PDF reader doesn't mean their users should be restricted from doing so.

    • Re: (Score:3, Informative)

      by SanityInAnarchy ( 655584 )
      *cough* *sputter* What?

      Slashdotters always making me spill my coffee...

      Oh, I see... is the issue that people are running older versions of Acrobat?

      If they can't be bothered to upgrade to the latest version, what makes you think they'll patch themselves? Are you suggesting that the big advantage of me running Free Software here is that I could be running kpdf 0.2 and patch the security holes? Or are you suggesting that someone who can't be bothered to update their software is going to have a better time of i

      • Re: (Score:2)

        by jbn-o ( 555068 )
        What I said was perfectly clear. Whether users want to upgrade to an ostensibly (we don't really know, nor are we allowed to check) more secure version of any given proprietary program is their business and a red herring of an issue. But Adobe shouldn't restrict its users from fixing and helping others fix Adobe programs. The way things are now, Adobe's users can only get the improvements Adobe deems necessary on Adobe's schedule and they must also get any downgrades that come along with those fixes. Su

        • But Adobe shouldn't restrict its users from fixing and helping others fix Adobe programs.

          I don't agree with RMS; I think that's entirely their right. As a user, it means I'm much more likely to use KPDF, but at no time do I think they "shouldn't do that".

          I'm not sure if this is still the case when a monopoly is in effect -- for instance, I do consider it a bit unethical the way the Flash specs are presented, especially when it seems to be wanting to replace the Web. (Entirely -- Flash itself has a plugin

  • I bought and paid for a license for Adobe Acrobat v6. Where's my update? I have no plans whatsoever to pay for an upgrade that consists of bloatware just to get a security fix. The manufacturer, Adobe in this case, should be liable for this flaw since it has now been pointed out to them. For all vulnerable versions.
    • If vendors would be responsible for their faulty software there wouldn't be any of the larger software companies around anymore.

      It would be a much better world if software engineering would grow up and would be kept to the same standards as "proper" engineering though.

      • > If vendors would be responsible for their faulty software there wouldn't be any of the
        > larger software companies around anymore.

        And this would be a bad thing why?

        • Re: (Score:2)

          by Sancho ( 17056 )
          There would effectively be no software, and thus no computers.

          A luddite might think that's ok....
          • > There would effectively be no software...

            All the software I use would still be available. So would most closed-source software: most does not come from the "larger software companies".

            • Re: (Score:2)

              by Sancho ( 17056 )
              The implications of vendor responsibility extend far beyond just large companies. The Linux kernel has had flaws, too. If someone was accountable for them, those people probably wouldn't continue writing software.

              I've rethought things, though, and I think that what would really happen is that only large software houses would exist, and they'd have to carry insurance on their products. That's effectively how they'd deal with being responsible for flaws. Software prices would be higher because of this, an
    • So just out of curiosity - how many versions should Adobe be fixing? I want my fix for Acrobat Exchange 1.0 (1993).

  • Benifits of Adobe Reader? Seriously. (Score:4, Informative)

    by Nemilar ( 173603 ) on Saturday February 09, 2008 @01:35PM (#22361632) Homepage
    Seriously, Adobe Reader has gotten huge in terms of file size, when compared to xpdf/kpdf/foxit/etc. I'm wondering if someone can explain to me what all this extra code is for? Obviously it must be doing something, but personally I've never seen the difference.
    • I don't know what the exra code is doing, but the fact that only one of those alternatives you offered works in Windows, (ordinary) people's options are severely limited.

    • Re: (Score:2, Insightful)

      by domatic ( 1128127 )
      Adobe appears to be moving away from PDF as "electronic paper" to "all singing all dancing Internet Document". You can now embed movies, audio, and javascript in PDF to make some sort of "active document". Personally, I think PDF has jumped the shark.
    • DRM, most likely.
    • Their various forms of DRM come to mind
    • I had to upgrade from Acrobat Reader 6 to 7 at work, more than a year ago. My memory is hazy and repressed but this is what I seem to remember.

      First you downloaded the upgrade installer for 7.0. It rebooted the computer. Then 7.0 started up, and downloaded the upgrade installer for 7.0.1. Then it rebooted the computer. Then 7.0.1 started up, and downloaded the upgrade installer for 7.0.2. Then it rebooted the computer. Then 7.0.2 started up, and downloaded the upgrade installer for 7.0.3. Then it rebooted t

    • Google to the rescue (Score:4, Informative)

      by plover ( 150551 ) * on Saturday February 09, 2008 @05:03PM (#22363430) Homepage Journal
      A quick Google turned up this list [daube.ch] of plugins, so if you want to pick and choose which bits of extreme uselessness you want to avoid, it makes it a bit easier. Seriously, does anybody think it's a good idea to let a PDF send an email?

      Anyway, if you remove any of those files from your Reader/plug_ins folder, Acrobat Reader won't load them at launch time. It speeds up loading time of ordinary PDFs tremendously.

      What I really really don't understand is why Acrobat Reader doesn't dynamically load those plug-ins only upon demand? Seriously, why does it need to bring in any of that extra code just to display a catalog page from a web site? Digital signatures? If the PDF doesn't have one, I don't need to load the code to verify it. Accessibility? I'm not handicapped, I don't need or use a screen reader, ever. eBooks? I've never bought one, and probably won't for many years to come. And I never, ever, ever want to let a PDF send an email. That's just WRONG.

      It's a tremendous load of crap, made worse by their "always load, just in case" philosophy.

    • I use it because the model manuals I use have embedded 3d graphics:

      http://www.youtube.com/watch?v=F2dKBYRQj68 [youtube.com]

      It's nice when you can grab a part and spin it virtually to see exactly how the assembly should look.
    • Acrobat/Reader actually has a huge amount of customer requirements. For example it can display and render forms, interact with web services/databases, display 2d/3d annots, display flash/wmv/quicktime movies, play sounds etc, and sign/create digital signatures. It also has a javascript engine.

      Funny thing is - if you remove all those extra plugins so that it has as much functionality as kpdf and foxit reader it has a smaller memory footprint and loads faster than either.

  • disable javascript (Score:5, Informative)

    by bcrowell ( 177657 ) on Saturday February 09, 2008 @01:45PM (#22361706) Homepage

    The article doesn't say explicitly, but I'm assuming this is related to the fact that the default configuration of AR will execute javascript that's embedded in pdf files. This is both a privacy issue (people can track readers) and a security issue (more than one stack overflow bug has been discovered that's related to js). To disable js, go to Edit, Preferences, JavaScript, and uncheck "Enable Acrobat JavaScript".

    There have been a lot of posts along the lines of "why the hell even use AR?" Well on Linux, I actually have Firefox set to open pdf files in xpdf, because it's faster, and I also habitually use xpdf to view pdf files when I'm not in a browser. (Evince is a little slower, but a little more full-featured and modern.) But I also have a copy of AR 8 installed on my Linux box, because it has some features that I find really useful once in a while, and also I want to be able to test my pdf files sometimes and make sure they'll look right for AR users. It's one of only two proprietary apps I have on my machine, the other being Flash. It would be great if the OSS community could produce a pdf viewer that was just a little more full-featured than Evince. (Flash is a whole different issue -- many of the things Gnash can't do, it can't do because of patents.)

  • Maybe I misunderstood... but who the hell uses .pdf for banner ads anyway?

    I, for one, would also recommend other readers. The most recent incarnation of Adobe Reader is even slower than before, and they took a perfectly usable interface and messed it up.

    Whatever happend to, "If it ain't broke, don't fix it!" ??

  • Hello? Flash?! (Score:3, Informative)

    by Dachannien ( 617929 ) on Saturday February 09, 2008 @02:14PM (#22361962)
    People have been doing this with Flash (another now-Adobe product) for ages. One flash ad redirects you to a second flash widget on a malicious website to get around Adobe's lame attempts at cross-site protection, and that second flash ad gives you the business.

    Malware, that is. Intarweb gold. Russian tea.

  • "At this rate there won't be many safe applications left to use."

    One can only hope this comes to pass. Perhaps if mostly everything on the planet is compromised people will actually care enough to do something about it.
  • Funny that I should read this headline RIGHT NEXT to an Adobe Acrobat ad being run on /.
  • Interesting that people still use it that much. It is so much bloat now that it's kind of a bust.
  • Wishing I wasn't forced to use Acrobat for increasingly many eBooks... [gnu.org]

    While Touretzky prefaces his page on the subject with "Computer professionals who have examined these mechanisms have found them easy to defeat" [cmu.edu], I miss something able to decrypt or print the latest crop -- where APDFPR [elcomsoft.com] says

    APDFPR Error
    The document was created with 'eBook Exchange (EBX_HANDLER) 128-bit security v.3' encryption handler. This protection method is not supported.

    Yet I see some nicely decrypted ones floating around. E.g.

  • Reader seems to be able to overwrite the current version, but if you have damaged version of older reader installed(5,6,7) you have serious issues trying to get rid of those things.

    Does anyone have good resources for removing old versions of adobe reader manually?

    Adobe website comes pretty much empty when looking for cleanup tools.

Slashdot Top Deals

"The medium is the message." -- Marshall McLuhan

Close