Forgot your password?
typodupeerror
Google Security IT

Google Employees Find 60 Security Holes In Adobe Reader 164

Posted by Soulskill
from the is-that-all dept.
sl4shd0rk writes "Upon examining the PDF Engine behind Google Chrome, Google employees Mateusz Jurczyk and Gynvael Coldwind discovered numerous holes. This led them to also test Adobe Reader, which turned up around 60 holes which could crash the PDF reader, 40 of them being potential attack vectors. The duo notified Adobe, who promised fixes, but as of the latest updates (Tuesday of this week) for Windows and Macintosh, 16 of the reported flaws are still present (the Linux version has been ignored). To prove it, Mateusz and Gynvael obfuscated the info and released it, saying the unpatched holes could easily be found. The Google employees therefore recommend that users refrain from opening any PDF documents from external sources in Adobe Reader."
This discussion has been archived. No new comments can be posted.

Google Employees Find 60 Security Holes In Adobe Reader

Comments Filter:
  • PDFs (Score:5, Insightful)

    by girlintraining (1395911) on Friday August 17, 2012 @03:07PM (#41027857)

    PDFs have been a security headache for decades now. It originally started as an evolution of PostScript, but has since morphed into a "document solution". Adobe, like so many tech businesses, can't simply create a tool and then be finished. They always have to add more features, more code, more bloat. And surprise surprise, problems arise.

    When I go to work on my car, I know my ratchets will work on any bolt on it; I just need to figure out what size it is and maybe an extender and I'm in business. My tools just work; they rarely break, and they don't stop working with next year's model... or the next decade's. Or the last. My ratchets will work on 1950s model cars, and I'm sure they'll still be useful on a 2050 model car.

    Linux is more like my ratcheting set. Sed, awk, bash scripts... they don't change. They were there 5 years ago. They'll be there 5 years from now. They're simple, dependable, and "just work". What the fuck is so hard about making a read-only flat document that does the job of being easily readable and printable well? Stop adding features. Make the product do one thing well, and then use the profits to make a completely different product if you need something else done well.

    Be like the ratchet.

    • Re:PDFs (Score:5, Insightful)

      by Eponymous Hero (2090636) on Friday August 17, 2012 @03:10PM (#41027917)
      imho it got out of control when they added executable javascript.
      • Re:PDFs (Score:5, Informative)

        by Jeremiah Cornelius (137) on Friday August 17, 2012 @03:37PM (#41028291) Homepage Journal

        Postscript - integral to PDF internals - is itself a Turing-complete language, derived from Forth.

        It will always be a problem.

        • Re: (Score:2, Informative)

          by Anonymous Coward

          That's true, but PDF is a subset of Postscript rather than a generalized programming language. For example, the control structures are removed (if, loops, etc.) It should have been possible to put many more limitations on it. Instead, they added back even more ways to shoot yourself in the foot (e.g., Javascript). That's just nuts, and explains why Adobe Reader has been a bloated, ever-expanding program since... well, forever.

          What they need is a "Lean PDF" that is strictly limited to describing the page

          • by JDG1980 (2438906)

            What they need is a "Lean PDF" that is strictly limited to describing the page content, with no internal programmability.

            This subset already exists, and is known as PDF/A [wikipedia.org].

        • Re:PDFs (Score:4, Insightful)

          by bcrowell (177657) on Friday August 17, 2012 @08:33PM (#41031887) Homepage

          Postscript - integral to PDF internals - is itself a Turing-complete language, derived from Forth.

          It will always be a problem.

          No, because PDF, unlike PS, was intentionally designed to be Turing-incomplete. That was a good design decision, which was then unfortunately screwed with when they added javascript.

      • by bigtrike (904535) on Friday August 17, 2012 @04:29PM (#41029199)

        The javascript you can add to the PDF through a GUI or the javascript that you can embed into hex strings when writing a PDF file? The files are a hacky mix of text and binary. Some data types define their length, others have insane rules for end markers and escaping. Hex strings were originally pretty easy, but then they decided that they'd add javascript support into the parsing so you can constants that vary conditionally on the PDF version number. On top of that, you practically have to build a run time to render the PDF because of the complexity of its nested viewport stacks and viewport modifications that can be executed at any time in the PDF.

        If that wasn't enough, they made it way more complicated when they hacked in support for JetForms (now known as LiveCycle), which is an XML language with poorly thought out data types and full of rendering hints that would be really useful if the documentation said more than "ignore these if you're not Adobe". If you want to save a PDF created with LiveCycle that a reader other than Acrobat can read, it's saved in both forms, resulting in a file that's 3x the size of a PDF.

        • pdfs are supposed to be rich formatted text documents that can embed images, nothing more. by allowing document creators to embed javascript, they open this medium up to many of the same, and some unique, attack vectors. here's just one example that made the news: http://www.zdnet.com/blog/security/adobe-confirms-pdf-zero-day-attacks-disable-javascript-now/5119 [zdnet.com]. the same poisoned pdfs when rendered through a pdf reader without javascript execution capabilities are harmless. it doesn't really matter how the
        • ..and I'd like to point out that the rendering hints in these forms have already been exploited by malware for executing malicious instructions on Windows and OS X. While Adobe hasn't documented it for third party users, it's trivial for malware attackers to fuzz the engine and discover methods of exploiting these features for their own use.

          Interestingly, Apple got around some of this with their Preview app by treating any area of the display PDF that has a form-like decoration as if it were a form -- so

    • Re:PDFs (Score:5, Insightful)

      by Meshach (578918) on Friday August 17, 2012 @03:18PM (#41028019)

      Stop adding features. Make the product do one thing well, and then use the profits to make a completely different product if you need something else done well.

      Be like the ratchet.

      That works for an open source project where the ultimate goal is to provide a usable product. If the project is already usable then do not add more features. Adobe though is a commercial product. They have to constantly change things and add new features so that their customers will need to upgrade to the latest version. This constant upgrading inevitably introduces instability.

      • This constant upgrading inevitably introduces instability.

        No wonder if you're trying to build a skyscraper from this. [reference.com]

    • Re:PDFs (Score:5, Insightful)

      by fm6 (162816) on Friday August 17, 2012 @03:36PM (#41028273) Homepage Journal

      Lots of products get "improvements" that are anything but. The point of making stuff is to sell it, and you can't sell new stuff unless you can convince folks that their old stuff is obsolete. You can see that any time you visit a car dealer.

      Ratchet design isn't static because their makers woke up one day and said, "It's perfect! Let's stop trying to improve it!" They just don't have any design improvements that will convince you to throw out your old ratchets and buy new ones. If they could, they would.

      • by Burning1 (204959)

        Ratchet design isn't static because their makers woke up one day and said, "It's perfect! Let's stop trying to improve it!" They just don't have any design improvements that will convince you to throw out your old ratchets and buy new ones. If they could, they would.

        Not to be pedantic, but they have made many improvements to ratchets over the last 50 years.

        - Ergonomic handle shapes
        - Fine tooth ratcheting mechanisms (helps work in small spaces)
        - Low profile designs
        - Flex heads
        - Different reversing mechanisms

    • This reply is about your ratchets. Believe me the same thing is happening with mechanical stuff. Just look at the number of times Apple has changed fasteners on their iPhone so you can't open it without buying another tool. It's all part of the plan to keep you in the fold.

      • by Trepidity (597)

        On cars, too, for that matter. Anything 1980s or earlier can generally be worked on with classic mechanics' tools, but 1990s and later stuff has an increasing amount of custom and electronic parts that need specialized tools.

        • by cusco (717999)
          Most American cars now have covers over areas of the engine that need a custom tool, normally only available through the dealer, to get off. There are some models where you can't even get to the bloody spark plugs without a custom 7-sided Allen wrench. So far VW and Toyota seem to have avoided that particular bit of stupidity, don't know about the other non-US manufacturers.
          • Re: (Score:3, Funny)

            by ColdWetDog (752185)

            Oh this has been going on for years. Even before the 1980's - SAAB, Volvo - I'm looking at you with your weird little engine tools. British stuff didn't need anything special (other than Whitworth wrenches) - a hammer and a screwdriver would disassemble pretty much any Triumph, Spitfire or Land Rover engine ever made. Of course, they couldn't hold a quart of oil for more than 48 hours, but you never had to actually change the oil, you just replaced it.

            • What, you mean metric spanners and sockets (and before that SAE)? Seriously Volvo put perhaps more thought in how things come apart than most other manufacturers. With 80s Volvos if you've got a bolt and a nut, they're typically different sizes (ex 17mm + 18mm instead of 2x 17mm). The bonus here is you can use one set of tools.

              Whitworth... now that's weird (unless you're Australian).

              • by dbIII (701233)
                Whitworth is the mechanically ideal thread, but it's at an angle that doesn't match up with anything you'll get if you divide a circle by 360 parts. That put it into the "too hard basket".
                • Wasn't about 3 Whitworth wrenches capable of removing an Engine from a Centurion tank? We'll that and a hammer.

    • I'm in a devils' advocate mood today... I don't particularly like Adobe (nor do I hate them particularly), and I think reader is a bloated piece of crap.

      But Reader changed not because Adobe has a PDF agenda to rule the world, but because Adobe economically needed it to change. To make money, gain market share, whatever.

      A ratchet is a simple tool, one whose expectations won't change. But software (and cars) are much more fluid. Your ratchets may work on your 1950's car, but you won't like driving it. Engine

      • Mmm. Wrong. Modern ratchets (at least the higher end stuff) often have many more teeth than older ratchets. This allows them to be useful in more confined spaces. Both tools and expectations have indeed evolved. Someone who's used to the flexibility a new SnapOn Dual 80 ratchet afford probably wouldn't be super happy with an old 30 tooth model.

      • I'm in a devils' advocate mood today... I don't particularly like Adobe (nor do I hate them particularly), and I think reader is a bloated piece of crap.

        But Reader changed not because Adobe has a PDF agenda to rule the world, but because Adobe economically needed it to change. To make money, gain market share, whatever.

        A ratchet is a simple tool, one whose expectations won't change. But software (and cars) are much more fluid. Your ratchets may work on your 1950's car, but you won't like driving it. Engines are better now, tires are better, handling is better. You'll hate the boaty-ness of your 50's era driving, the gallons-per-mile you pay for driving it, the lack of safety features, the lack of DVD player dropping from the roofline for your kid in the back seat. I wonder simply how many safety regulations that would prohibit a "new" 50's tech car being sold. Adobe finds it difficult to get money out of a non-bloated Reader the same as any car company would go out of business if it sold nothing but 50's tech in cars.

        What Adobe should have done is let some group without a profit motive - or a need to bloat it to hell - take over development. Such groups do exist - Apache being the best example. Adobe wants PDF to both be a universal utility, and a tool to bind you exclusively to Adobe. Those goals conflict.

        May I introduce you to GhostScript? http://en.wikipedia.org/wiki/Ghostscript [wikipedia.org]

        Unless you want the bells and whistles that introduce security holes, Ghostscript is what you want as a PDF reader/writer. Reader *IS* the bloatware version. There's lots of other readers and writers out there that can handle the actual PDF standard; Reader just handles the bloat.

      • The problem IMHO with Adobe is that their tool is flawed and they don't care. For example, their encryption, which they actually had someone put in jail for presenting a paper on, was identical to that used by Julius Caesar and a number of cut out codewheels for entertainment on the back of cereal boxes. It was a substitution code where each letter was replaced by a letter a set number of letters later in the alphabet - so solvable in under a minute by an average ten year old with one of those cereal box
    • by RDW (41497)

      Linux is more like my ratcheting set. Sed, awk, bash scripts... they don't change. They were there 5 years ago. They'll be there 5 years from now. They're simple, dependable, and "just work"... Stop adding features. Make the product do one thing well, and then use the profits to make a completely different product if you need something else done well.

      So you're not an emacs user then?

      • Linux is more like my ratcheting set. Sed, awk, bash scripts... they don't change. They were there 5 years ago. They'll be there 5 years from now. They're simple, dependable, and "just work"... Stop adding features. Make the product do one thing well, and then use the profits to make a completely different product if you need something else done well.

        So you're not an emacs user then?

        vi'e alway's thought of emacs as an OS....

    • by onyxruby (118189)

      Be like the ratchet.

      Point well made - something I wish more utilities would do. I would rather have a stable and secure PDF tool than a feature rich one constantly needs updated and patched.

      • Be like the ratchet.

        Point well made - something I wish more utilities would do. I would rather have a stable and secure PDF tool than a feature rich one constantly needs updated and patched.

        So use Ghostscript. Unless you're actually using the bloatware features, there's no reason to use Adobe Reader. OS X has Preview, Windows has Foxit Reader, and everyone has Ghostscript. None of them are as good at *creating* PDFs as Acrobat, but they're all better than Reader at reading them without destroying your security model and eating up resources.

        • by Cederic (9623)

          Exactly. Nobody needs Adobe Reader installed and everybody should avoid it.

          Sadly at work I have Adobe Acrobat installed. Not my choice.

    • My ratchets will work on 1950s model cars, and I'm sure they'll still be useful on a 2050 model car.

      Your ratchets, sure. Your sockets, not so much. Plenty of new types of fasteners have been introduced since the 1950s (TORX/E-TORX/TORX Plus, Pozidrive, metric hex stuff, etc).

    • Nothing here is new. I bet even the security findings

      This is all a chrome advertisement.

      "how to make people use our plugin instead of the free reader with lots of features?"

      They only failed to realize that people that even uses pdf probably use "secret" for their email password

  • I'd like to see them include some of the alternative readers (Foxit, etc.) included in their testing since they are somewhat popular among people who have thought that Adobe Reader was bloated and slow for quite a while.

    • I tried Foxit

      My Quickbooks has Adobe PDF writer built-in (only good for QB use!)
      Somehow, that has made Adobe Reader get called in FF instead of Foxit.

      It reminds me of the file association wars between Quicktime, WinAmp and WMP.

    • by gmuslera (3436) on Friday August 17, 2012 @03:34PM (#41028239) Homepage Journal
      In Ubuntu (and probably other distributions and gnome based desktops) the default viewer is Evince, in KDE ones is Okular, and you have embedded viewers in other apps, like in google chrome. There is no need to install Adobe's unless you need some special added feature. A list of software that works with PDF can be found in Wikipedia [wikipedia.org]
      • by SQLGuru (980662)

        I know about the alternatives.....but what I want to know is if any of them have the same security holes (or conversely, which PDF viewer is the most secure).

        • by gmuslera (3436)
          Is implicit in the announcement that at the very least the Chrome embedded viewer should be safer. Anyway, probably the other viewers are based in the pdf specification not in acrobat reader code, so they shouldn't share some if not all those vulnerabilities (but could have different ones)
        • by nzac (1822298)

          They don't have the same ones. The alternatives focus on an old PDF standard, that is what almost all PDF documents are and don't include all the executable stuff.
          As far as i know the alternatives very rarely have issues, I can't remember ever seeing a security for evince.

      • by antdude (79039)

        What about handling forms and complex features?

  • And in other news... (Score:5, Interesting)

    by kootsoop (809311) on Friday August 17, 2012 @03:09PM (#41027899) Journal
    Google announces a new initiative: Google Document Format, for all your document sharing needs.
    • by steelfood (895457)

      Why create a new document format? There already are enough free, open, standard ones out there to fill every niche. There's ODF for WYSIWYG. There's LaTex for typesetting (PDF replacement). AJAX and HTML5 for interactive pages.

      It's just a matter of enabling them in Chrome, and offering it in their search. For example, they could build LaTex and ODF viewers right into Chrome. They can then convert every PDF and Word Doc into LaTex and ODF to be displayed in this embedded viewer. Present a "Convert to LaTex"

      • Present a "Convert to LaTex" button for every PDF file their search result indexes and do the same for Word docs and ODF. Instead of "view as html", use "view as LaTex" and "view as ODF".

        Anybody who wants to view PDF and Word Docs natively would then have to download and open the file up in the viewer manually.

        Converting PDF to LaTeX would be like convering Java bytecode to Java source... sure, it's possible, but editing it isn't going to be very pretty and the output's going to be really bloated....

      • by imsabbel (611519)

        Thats funny, with the LaTeX... as the only way LaTeX actually looks nice is after you have converted it to PDF...

  • by nighthawk243 (2557486) on Friday August 17, 2012 @03:10PM (#41027913)
    >Adobe in charge of security.
  • by Hatta (162192) on Friday August 17, 2012 @03:14PM (#41027967) Journal

    Google was irresponsible in not publishing these holes immediately so affected users could take steps to mitigate their vulnerability while Adobe put together a patch.

    • You really think nobody else knew about these already? per your sig censorship is obscene is this any different? Whats the downside the vulnerabilities are not there and thus not an issue or people can be informed and mitigate them? You can only guess that nobody else has discovered an issue it's better to assume somebody has and fix it than to sweep it under the rug.

    • by bill_mcgonigle (4333) * on Friday August 17, 2012 @03:35PM (#41028259) Homepage Journal

      Google was irresponsible in not publishing these holes immediately so affected users could take steps to mitigate their vulnerability while Adobe put together a patch.

      The Full Disclosure folks say that vulnerabilities should be disclose immediately. Their arguments have some merits. The Responsible Disclosure folks say that the vendor should have n number of weeks to get a patch out, then it goes to Full Disclosure. That has some merits as well, but the trouble is the public doesn't know there's a problem during the n weeks. The calculation is a balance of how many people will be protected vs. how many people will be harmed.

      It occurs to me that a third way, call it 'Informed Disclosure' for now, would be to:

      1. Make an announcement that x number of vulnerabilities have been discovered in the foo function of bar
      2. Wait the n number of weeks
      3. move to Full Disclosure

      as a way to avoid the problem with Responsible Disclosure but still give the vendor reasonable time to react. e.g. 'Informed Disclosure' may say:

      ISSUE-001: Acrobat Reader has a vulnerability with JavaScript objects embedded in documents that can cause a smashed stack. Disable JavaScript in Acrobat Reader to avoid this problem.

      and then send Adobe the exploit code, which will be published in 45 days. This also removes the illusion of potential blackmail from security researchers, because the public has on-record information that the disclosure will be published, regardless of the action or inaction by the vendor.

      Surely others have taken this approach, but I can't find a name attached to it -- anybody?

      • You can get a CVE nuber reserved for your vulnerability I believe? I guess you could give a description at that moment and publicly open the CVE later on?
      • Depending on how big foo() is, simply indicating where the vulnerability is may be enough to allow black hats to find it.

      • Um, the public doesn't know it's a vulnerability for n+x weeks where x is the # of weeks between the vulnerability was created and when it was discovered.. The detection of the vulnerability isn't actually responsible for the vulnerability.... Your proposed solution would be the worst of both worlds.... Letting everyone, including potential attackers, know that vulnerabilities exist without actually giving anyone any real way to protect themselves as the announcements don't contain any real information...
  • by Anonymous Coward on Friday August 17, 2012 @03:15PM (#41027981)

    Those fucking slackers could only find 60 holes in that Swiss cheese? And, they couldn't even bother looking at Flash!

    Oops, I have to go. My PC needs to reboot after the third Flash and Reader update today.

  • by Anonymous Coward

    I guess they just Googled it...

  • The name of the researcher "Gynvael Coldwind".

    Too cool, in more ways than one. :D

  • I just removed it from my browser a while ago after I finally got sick of it crashing. I now use Okular to read PDFs and life is much better that way. I don't know why anyone would tolerate such a miserable plug-in.
  • by fm6 (162816) on Friday August 17, 2012 @03:23PM (#41028093) Homepage Journal

    The summary muddles two distinct PDF readers, the PDF reader built into the current version of Chrome (purely Google) and the PDF reader from Adobe that's completely separate. The Google reader is relevant only because the vulnerabilities in the Adobe reader were discovered using the tools developed to find vulnerabilities in Chrome.

    • by Trepidity (597)

      The PDF reader in Chrome doesn't seem to be purely Google. On this page [google.com] comparing Chrome to the open-source Chromium distribution, they mention that they can't open-source the Chrome PDF reader because:

      The Chrome PDF plugin uses 3rd-party non-free code; no Free Software PDF plugin exists that supports all the PDF features we'd like (such as filling in forms). :(

      Whose third-party code? Adobe's? Someone else's?

      • by fm6 (162816)

        Chromium seems to have diverged a bit from Chrome. The Google PDF reader I was describing is built into Chrome. It's not a plugin. I can't say for sure that it contains no 3rd party software, but I doubt it. It's pretty feature-limited.

        • That's incorrect. There's never been a PDF reader built into Chromium. The Chrome PDF reader (added in Chrome 8) has always been licensed third-party code in a plugin that ships with Chrome. It's fully sandboxed using PPAPI and has been aggressively audited and fuzzed (this latest round of fuzzing just used a more advanced toolset, so it found new things).

          • by fm6 (162816)

            There's never been a PDF reader built into Chromium.

            Reading skills, dude. I didn't say there was.

            • Sorry, the antecedent in my response was a bit misleading. What I was correcting was the claim that the PDF reader wasn't a plugin. It's in fact a plugin that ships with the browser (like the Flash plugin does). Third party plugins have always been a difference between Chromium and Chrome, because there's no license to distribute the binaries outside of the official Chrome builds.

    • by jhol13 (1087781)

      Besides, would they have used tenth the time in Linux, Windows, iMacos, or whatnot, they would have found at least twice the amount.

      I am extremely disappointed on Linux "security" (i give a shit about W or i). I get several updates every day. This has gotten worse since -90, and is getting much worse extremely fast.

      We FUCKING need ABI! We FUCKING need design (and I do not mean kernel alone).

  • I had Reader on my Mac because I had to cryptographically sign something. Is there something out there that does both forms and cryptographic signing?

    Also, I forgot about Reader until something asked me to update it. I promptly deleted it, but where did the updater spawn from? Id love to remove all adobe code from my machine.

    • Fortunately, most Mac users don't need Reader at all. Preview handles PDF viewing very well and is amazingly fast.

      I have Acrobat Pro installed out of necessity (for work), but all of its auto stuff is turned off - I really only need it once or twice a year. But still... I consider Acrobat a malignant tumor on my hard drive. I may have it walled off, but it's still there, patiently waiting for a chance to spread its poison...

      Really, the world would be a better place if people used alternatives to Adobe softw

    • by kybred (795293)

      Also, I forgot about Reader until something asked me to update it. I promptly deleted it, but where did the updater spawn from?

      I fired up Reader yesterday and it popped up that there was an update, so I told it to go ahead. Then a dialog came that that it needed to restart to finish the update. I clicked 'Restart' thinking that Reader was going to restart. No, it restarted my fscking PC! Reader needs to DIAF! And it's updater!

  • Setting up Google Chrome as the default PDF reader is more secure, and it's one less program to update. To do so in Windows 7 just right click on a PDF file, click "open with", click "choose default program", click Browse, and Browse to the following file:
    C:\Users\\AppData\Local\Google\Chrome\Application\Chrome.exe

    Adobe Reader does have some features that Chrome lacks, but 95% of users will be perfectly fine with just Chrome.

    • by idealego (32141)

      Slashdot messed up the path name. Where you see the double slashes is obviously the user name.

    • by JDG1980 (2438906)

      Setting up Google Chrome as the default PDF reader is more secure, and it's one less program to update. To do so in Windows 7 just right click on a PDF file, click "open with", click "choose default program", click Browse, and Browse to the following file: C:\Users\\AppData\Local\Google\Chrome\Application\Chrome.exe

      I had considered doing something like this, but I'm not at all sure I want Google to have full information on my reading habits. (I already have Chrome installed for Facebook only, since it can

  • Use free open source software instead:
    http://pdfreaders.org/ [pdfreaders.org]

  • For saving my time, my sanity and the health of my PC, I've tried to avoid dealing with Adobe bloatware as much as I could. Under Windows most PDF can be opened instantly with Foxit. It's free, it's fast and it works for 99% of the files. I keep Acrobat Reader on my PC "just in case". I never open PDF files with the browser plugin (I disabled it), I prefer to download the file to the desktop and view it offline. It's faster and safer. I'm using an old version of Foxit with no builtin javascript support and
  • by SD-Arcadia (1146999) on Saturday August 18, 2012 @05:21AM (#41034495) Homepage
    If you're stuck on windows and are sick of Adobe and FoxIt (yes that's bloated now too), I recommend Sumatra [kowalczyk.info]. It's gotten really fast with launching and rendering now, and as a bonus will open your e-book formats which I find is a logical addition to a document viewer. As long as you don't actually need the Adobe magic forms, Sumatra is the better, sane solution to just view pdf's and similar.

Real Programmers don't write in FORTRAN. FORTRAN is for pipe stress freaks and crystallography weenies. FORTRAN is for wimp engineers who wear white socks.

Working...