Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security

Adobe Warns of Security Flaw in Reader 20

Posted by Zonk from the quick-fix dept.
isusmiley writes "Adobe Systems Inc. issued a warning on its Web site Tuesday saying that the flaw affects only the Adobe Reader versions 5.0.9, 5.0.10, which were written for the Unix computer operating system. Adobe has since posted a fix for the vulnerability on its site, and a spokesman said Wednesday he was unaware of any security breaches resulting from the software flaw, which was discovered by the security defense firm IDefense, headquartered in Reston, Va."
This discussion has been archived. No new comments can be posted.

Adobe Warns of Security Flaw in Reader More

Adobe Warns of Security Flaw in Reader

Comments Filter:

  • Note (Score:3, Funny)

    by Otter ( 3800 ) on Thursday July 07, 2005 @04:07PM (#13007168) Journal
    Current versions for Linux and Solaris seem to be OK, anyway. It's the current AIX and HP-UX versions that are bad.

    So much for 2005 being The Year Of AIX On The Desktop!

  • Oh good (Score:3, Interesting)

    by Dammital ( 220641 ) on Thursday July 07, 2005 @04:19PM (#13007299)
    Adobe's recommendation is to replace their vulnerable version 5 reader with the spyware version [lwn.net] 7.

    That's progress. Of a sort.

  • was still using versions that old. I've been on 6 and/or 7 (depending on work/home) since they came out and haven't seen the problems mentioned.

  • I'll see your flaw, and raise you DRM (Score:5, Interesting)

    by hacker ( 14635 ) <hacker@gnu-designs.com> on Thursday July 07, 2005 @05:25PM (#13008021)
    "Adobe has since posted a fix for the vulnerability on its site, and a spokesman said Wednesday he was unaware of any security breaches resulting from the software flaw..."

    Two words: Show me .

    Prove that the "flaw" exists. Just saying "Clicking on the whatchamacallit causes bad things to happen, please upgrade." isn't enough.

    Show me that this isn't some FUD to force users to upgrade to a version that isn't riddled with the latest DRM that they "forgot" to put into those versions?

    Show me that this version doesn't fix a vulnerability that exposes passwords in PDFs read with it.

    Show me that this isn't more ass-covering by Adobe, again.

    Until then, xpdf, gpdf and other non-Adobe variants are all working fine. Nothing to see here, move along.

    • I don't know whether you read the actual details of the flaw, or not. From your response, I doubt that you did.

      Essentially, whenever Reader 5.0.9 or 5.0.10 opens a PDF file, it creates a randomly named duplicate in /tmp which can then be read by other users with the appropriate permissions, which makes it a local file disclosure vulnerability. When the file is closed in Reader, the duplicate created is then destroyed.

      In addition to the recommended upgrade to version 7, there is a version 5.0.11 which ad

      • Essentially, whenever Reader 5.0.9 or 5.0.10 opens a PDF file, it creates a randomly named duplicate in /tmp which can then be read by other users with the appropriate permissions, which makes it a local file disclosure vulnerability.

        So in version 7, I see that it creates the temp copy in RAM (mkstmp()), but now its vulnerable to be read in a much different way. On Hyperthreaded processors (i.e. multicore from Intel), since the processor itself has a shared cache, both cores need to be able to read fr

        • If one core opens the pdf, any process running on the other core can read the contents as they pass across the cache. Oops!

          Not a problem specific to Adobe...
  • Adobe's reader has turned into this huge bloated mess. The more complicated you make the software, the easier it is to have security holes slip by.
    Apple has great PDF reading and generation that comes free with OSX so you don't have to use the Adobe Reader. It's so nice to have a simple fast loading pdf solution.
  • hacker (14635), While I see your point that this could be a great way to have users upgrade to the new version I also see the point of not showing how to exploit the flaw as well. If it is indeed a flaw then I'm sure the flaw has been exposed on the Internet or irc channels. AdminPrep.com
  • I use Foxit Read (http://www.foxitsoftware.com/pdf/rd_intro.php [foxitsoftware.com]) as a replacement for Acrobat Reader. It seems to be faster, and that makes me happy.

    Andy
  • Considering the forum, I'm pretty sure the submitter could have said "UNIX" instead of "the Unix computer operating system".

    Most of us would have figured that one out.
  • I couldn't believe my eyes when I saw it. I suppose I'll go bakc to using KPDF or KGhostview.

    It's too bad what has become of Adobe. Bloatware + Spyware. It used to be a cool company.

Slashdot Top Deals

BLISS is ignorance.

Close