Foxit One-Ups Adobe In Blocking PDF Attack Tactics

CWmike writes "Foxit Software, the developer of a rival PDF viewer to Adobe's vulnerability-plagued Reader, released an update on Tuesday that blocks some attacks with a 'safe mode' that's switched on by default. Foxit Reader 3.3 for Windows' 'Trust Manager' blocks all external commands that may be tucked into a PDF document. 'The Foxit Reader 3.3 enables users to allow or deny unauthorized actions and data transmission, including URL connection, attachment PDF actions, and JavaScript functions,' the update's accompanying text explains. Last week, several security companies warned of a major malware campaign that tried to dupe users into opening rigged PDFs that exploited an unpatched design flaw in the PDF format, one attackers could use to infect users of Adobe's and Foxit's software. That flaw in the PDF specification's '/Launch' function was disclosed in late March by Belgium security researcher Didier Stevens, who demonstrated how he could abuse the feature to run malware embedded in a PDF document. He also reported he had figured out how to change Adobe Reader's warning to enhance the scam."

Adobe is down down down

[rcastro0]

Is it a coincidence that I read that Adobe is losing the grip on PDF just a few days after I read Job's "Thoughts on Flash [apple.com]", essentially dumping Flash from iPhones/iPads, and burning it at a stake? Or is Adobe's strategy really failing spectacularly before our own eyes?

I should've seen it coming -- I haven't used Acrobat Reader for years. PDF Xchange Viewer [docu-track.com] is my current favorite, though Foxit was my first off-Adobe alternative, back when.

Re:Sort of...

[Shados]

That line really bothers me. How many times before have ways been found around things like SQL sanitization procedures?

-Extremely few-, if you're talking about correct SQL management. The only one that comes to mind among serious RDBMSs (DB2, Sybase, SQL Server, Oracle, Postgres...) was a datatype exploit in Oracle that only worked locally, AND was more theoritical than anything.

Parameterized queries (the only good way of handling "sql sanitization") are virtually flawless. Now, if you're talking about string escaping, as is very popular on PHP/MYSQL stacks...well, yeah, thats swiss cheeze, dangerous, and bad practice (and unfortunately extremely popular)

Re:FoxIt for Linux?

[ichthyoboy]

You mean like they already have [foxitsoftware.com]?

Re:FoxIt for Linux?

[Culture20]

Just install Xpdf/evince and be happy. You don't need embedded crap in your documents.

And if cross-platform is what you're worried about, install evince on Windows. http://download.gnome.org/binaries/win32/evince/2.30/evince-2.30.0.msi [gnome.org]

Re:Adobe is down down down

[Anonymous Coward]

I'll probably need to get a Core i7 box because I NEED Photoshop

No you don't. I'm sure I read somewhere that newer versions of Photoshop support hardware acceleration using recent GPU's (Nvidia 8x 9x) either directly or through a plugin (I'm pretty sure Nvidia made a plugin for Photoshop to make use of CUDA).

Re:This is why PDF should be abandoned

[flyingfsck]

Uhhh, got news for you. Postscript is a programming language. Someone with too much time on his hands even wrote a chess program in postscript.

Since I can't change behavior...

[drumcat]

As an IT admin, I'm not getting anyone to drop PDF as a format. That's insane. But this, along with the 9.2 update installing McAfee without permission, has made me decide my company will be moving to Foxit. Adobe has screwed me for the last time. For anyone's info, if you have Reader 9.0, without the McAfee install selected, and you then do a "Check for updates" update from within the program, McAfee AV will be installed. I now have to UNinstall it from a shit-ton of machines. Adobe is famous for bad installers, but this takes the cake.