Homemade PDF Patch Beats Adobe By Two Weeks 238
CWmike writes "Sourcefire security researcher Lurene Grenier has published a home-brewed patch for the critical Adobe Reader vulnerability that hackers are exploiting in the wild using malicious PDF files, beating Adobe Systems Inc. to the punch by more than two weeks. Grenier posted the patch on Sunday with the caveats that it applies only to the Windows version of Adobe Reader 9.0 and comes with no guarantees. Also, PhishLabs has created a batch file that resets a Windows registry key to de-fang the hack by disabling JavaScript in Adobe Reader 9.0, giving administrators a way to automate the process."
Registry hack (Score:5, Interesting)
We figured that one out in about five minutes. Wrote a quick group policy file and moved on to the next problem.
Re: (Score:2)
what do you mean "group policy file"? Did you deploy via script or ADM file or what?
Share :)
I tried making a quick ADM file based on some ADMs I found here:
http://blog.stealthpuppy.com/deployment/deploying-adobe-reader-9-for-windows [stealthpuppy.com]
But apparently I didn't do it correctly, because JS was still on after I applied my setting.
Re:Registry hack (Score:5, Informative)
For myself I just used the REG.exe located inside the %system32% folder. in your logon script (assuming you have one), just add in the lines
REG add "HKCU\Software\Adobe\Acrobat Reader\9.0\JSPrefs" /v bConsoleOpen /t REG_DWORD /d 0 /f
REG add "HKCU\Software\Adobe\Acrobat Reader\9.0\JSPrefs" /v bEnableGlobalSecurity /t REG_DWORD /d 1 /f
REG add "HKCU\Software\Adobe\Acrobat Reader\9.0\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
REG add "HKCU\Software\Adobe\Acrobat Reader\9.0\JSPrefs" /v bEnableMenuItems /t REG_DWORD /d 0 /f
YMMV. REG.exe is not included on Windows 2000. Because this applies to the current user registry there should be no permissions issue. And make sure your path does include the system32 directory as by default.
Open source "more secure" than closed source? (Score:3)
So is this "user supplied" PDF fix an example of how Open Source is More Secure than Closed Source?
OSS users supplied a fix in less than a day, whereas a closed source programmer in some cubicle somewhere will take weeks to do the same. Maybe this would be a fine example to present to the UK Parliament and U.S. Congress, in order to convince them that open source is the best path to follow.
Yeah, right (Score:2)
[snip]Maybe this would be a fine example to present to the UK Parliament and U.S. Congress, in order to convince them that open source is the best path to follow.
And then the lobbying starts
Re: (Score:2)
The lobbying already started several weeks ago. Closed-source companies are trying to scare politicians away from open-source software by saying, "It's not secure."
Feature Request (Score:5, Insightful)
When loading a PDF, if Reader sees there's JavaScript that wants to run, Reader pops up a dialog along the lines of, "Hey, this file contains executable code which is, y'know, kind of contrary to the whole concept of a 'document'. Do you want to allow the code to run? [Yes] [[Hell, No]]"
This is the cheesy but mostly effective stopgap solution Microsoft adopted when Word became an infection vector for macro viruses. Unless Microsoft got a patent on it, I don't see any reason why Adobe couldn't also use the same approach.
Schwab
Re:Feature Request (Score:5, Insightful)
When loading a PDF, if Reader sees there's JavaScript that wants to run, Reader pops up a dialog along the lines of, "Hey, this file contains executable code which is, y'know, kind of contrary to the whole concept of a 'document'. Do you want to allow the code to run? [Yes] [[Hell, No]]"
Do you think that the average user will read anything before clicking "Yes"?
Re:Feature Request (Score:4, Funny)
How about: "Do you want to prevent the execution of possibly malicious code in this .PDF file?" [Yes][No].
If they select No, the next dialog is: "Fine. I've just opened all the ports on the computer, deleted the last 10 documents you opened up, and loaded up a couple trojans. Are you sure you want to run the executable code in this PDF file now?" [Yes][No].
This way, the user won't be taught to always select the same confirmation box all the time.
Re: (Score:2)
There is NO SUCH THING as idiot proof. Why don't we all just get over it and MOVE ON? The idiots will only get more inventive if we try to outsmart them.
Re:Feature Request (Score:5, Funny)
Re: (Score:2)
How about: "Do you want to prevent the execution of possibly malicious code in this .PDF file?" [Yes][No].
Yeah, that'll work. [slashdot.org]
Do you want to keep it just in case? (Score:2)
Don't cha just love the way the idiots rally round to say nothing can be done.
Just because the Yes then No questions only protects lazy idiots doesn't mean it's worthless. You know I think the marketing department must write all the Microsoft 'Confirmation dialogs' because they read like marketing copy ... always positive, never mention anything in a negative way, never let the mark even think of the 'N' word.
Then again here's a nice way of saying it ...
Do you really want to delete everything (y/N)?
D
Re:Feature Request (Score:5, Insightful)
Do you think that the average user will read anything before clicking "Yes"?
...of course they won't, which is why you turn it around to "Hey, this file contains executable code which is, y'know, kind of contrary to the whole concept of a 'document'. Do you want to block execution of this code? [Yes][No, I like to live dangerously]".
Re: (Score:3, Interesting)
And this is why we need to get away from labeling dialog box buttons "Yes", "No", "Cancel", etc. We can label them anything we want, so why not be descriptive? Try "Safe", "Unsafe", "Really Stupid", "Don't click this -- ever!"
The same applies to the save dialogs. I like how OO.org 3.0 handles the "Do you want to save?" dialog when closing the program: The buttons are labeled "Save", "Discard", and "Cancel". Of course, "Cancel" could be better described as "Return to Program."
Re: (Score:2)
They didn't rename cancel since "Cancel" unambiguously means "stop whatever I'm doing [and go back]" in ~any GUI.
Re: (Score:2)
That is the user's problem, I'm afraid. If someone is seriously that stupid, they probably shouldn't be allowed near a computer anyway.
Re: (Score:3, Insightful)
Unless you opt not to play.
Re: (Score:2)
[snip] Is it only windows that has the "Average User?"
no [ubuntu.com]. What's eating the mod (singular)?
Re: (Score:2)
Agreed, why would one want another programming language embedded in a programming language? Postscript already can do all you would want. It is a bit hairy programming, but it can be done (see f.x. http://www.physics.uq.edu.au/people/foster/postscript.html [uq.edu.au]). The best way to mitigate security issues with embedded code is to eliminate the execution. That is, until some one writes a javascript interpreter in postscript.
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
I'm going to have to disagree...
Allowing some scripting in a document is great. For example, I'm writing a math textbook [wordpress.com]. If PDF-javascript had a FOSS implementation, I'd use it to make interactive quizzes and questions in it. Sadly, while LaTeX has a package to do this, there is no support.
Before someone goes and says that I shouldn't be using a PDF in this case, please think. I'm writing a large textbook with lots of graphics. I want it to be in a single file so that its easily available to the technical
Re: (Score:2)
Except that it might not be paper. One can display LaTeX output as .dvi or .pdf (and Flying Spaghetti Monster knows what else).
I'll still rather do the active content in forms using MathML.
Re:Feature Request (Score:5, Informative)
Adobe did add this dialog -- but it only appears if you have disabled Javascript! (Which you can do with Edit / Preferences, no need for the registry hack.)
Here's the exact dialog:
? This document contains JavaScripts. Do you want to enable JavaScripts from now on? The document may not behave correctly if they're disabled.
[ ] Don't show this message again until this document is reopened
[[Yes]] [[No]]
Re: (Score:2)
The language used by most software in those situations is a big culprit:
> The document may not behave correctly if they're disabled.
Should say:
"the document may not have the author's expected appearance, but your computer will be safe from viruses"
Re: (Score:3, Interesting)
Feature request: a NoScript equivalent for Acrobat Reader.
Re: (Score:3, Interesting)
Or just make google open all your pdfs so that you aren't forced too even if its ugly its fast and secure.
Re: (Score:2)
Yanno, Okular runs on Windows and -IIRC- doesn't have all of these stupid issues.
See:
http://windows.kde.org/ [kde.org]
Re: (Score:2)
PDF files supporting Javascript isn't the problem. In this exploit, Javascript is used to get executable code in the stack, but isn't the crux of the problem. A buffer overflow in Adobe's image processing code is.
In what world does it make sense that an untrusted website can execute javascript, but an untrusted PDF can't? Javascript can actually be useful for PDFs: think forms where the contents of one field are added to th
JavaScript?! (Score:5, Insightful)
Seriously, JavaScript? In a PDF file? Why would you do that?
Re:JavaScript?! (Score:5, Funny)
Re: (Score:2)
Seriously, JavaScript? In a PDF file? Why would you do that?
I believe Adobe Version Cue's PDF review system is one of the applications that uses it.
The idea is that any PDF file posted to Adobe Bridge (design files repository, think SVN-lite) can have a web review process.
An administrator logs to the web interface and starts a review process which sends links to the reviewers. Once a reviewer logs in, they can download a copy of the PDF and start commenting on it and marking it up. When they're finished Acrobat sends only the comments back to the server instead of r
Re: (Score:2)
You've confused Bridge with Version Cue, and Version Cue with Acrobat reviews. Just sayin'
You are absolutely right, thanks for catching that!
Re:JavaScript?! (Score:5, Insightful)
Re:JavaScript?! (Score:5, Funny)
Then I quit drinking and realized Excel with tweaked permissions was far better suited to the task. It wasn't as smooth looking but it was easier for my staff to update.
what's wrong with forms? (Score:5, Insightful)
Pardon my ignorance, but exactly what other format should one use if one wants to use forms?
In my place of work, a large group of individuals each needs to fill out an annual form. It contains some short-answer questions, and a few that requires a few paragraphs to answer. In the past, they have used... wait for it... Word. Yes, I was forced to boot up Word once a year, to fill out this form. You should see the completely disastrous document that results.
For that reason, I always wished our administrators would have figured out pdf forms. You don't "edit" them, as you say; you fill them in. While there are many complaints to make about Adobe, I don't see the problem with pdf forms. Am I missing something?
Re:what's wrong with forms? (Score:4, Insightful)
FTFY (Score:2)
Just point them to a page on the corporate intranet, they put in their login, profit?
You're doing it wrong! It's:
Re: (Score:2)
if it's getting printed out then hand filled, use PDF, if it's getting filled out on the computer then printed use wordpad
Re: (Score:2)
, if it's getting filled out on the computer then printed use wordpad
If you haven't modified the text of a form HR sent out for you to print, sign, fax. IE removing the not from "I will not browse porn at work." Then you need to turn in your geek card. PDF file that lets you fill in name, address, etc digitally. Print, and sign without a easily modified format begging for touch-up.
Re: (Score:2)
Re: (Score:2)
true, but the pdf can't be turned into a joke by anyone in the company without extra effort using IT approved applications.
Re: (Score:2)
Am I missing something?
Yes, you have to pay to edit PDF's. Sure Word costs money too, but there are lots of good free alternatives, plus a lot of people buy Word anyway. If you only edit it once a year, that is a lot of money to be paying Adobe just to use their software a single time annually.
Re: (Score:2)
Well apart from anything else, they only work in Acrobat Reader. Which isn't the default PDF viewer on any platform except Windows.
This means that
(a) lots of people can't fill out the forms anyway, without installing additional software. Which may not even be an option on limited devices.
(b) if you publish eg feedback forms later, lots of people will wonder why you published a whole pile of identical blank forms
(c) if you used fdf forms (ie something compatible with older versions of Acrobat) the data and t
Re: (Score:2)
I've had co workers email me a PDF of a requirements document that was originally a word document.
Because they didn't want me to edit it.
Seriously. I half expected the person to ask for the file back when I was done.
Re: (Score:2)
Re: (Score:2)
Well here's a use case:
The document contains a form from officialdom which can be printed out as usual. Alternatively the PDF viewer enables entering of data inline for online submission. Here the JavaScript may activate client-side validation or pop up contextual help.
The limitation here seems not the concept but a failure of sandboxing such as Java applets provide - suspicious activity is prevented by the applet security manager.
Re: (Score:2)
A lot of companies actually use Acrobat/Reader for forms management - the code behind these forms is - you guessed it - javascript.
JavaScript in PDF a Bad Idea (Score:2, Insightful)
JavaScript in PDFs is, and always has been, a bad idea. I started disabling it years ago when it first showed up, and am continually frustrated that it is present, let alone enabled by default. How many PDF exploits have relied on JavaScript? I haven't been counting, but it sure seems like most of the vulnerabilities are either through JavaScript or made much easier to exploit by its presence.
Someone is doubtless going to say that JavaScript is critical to PDFs as a helper for filling in forms. OK, whatever
Here's how you turn out a patch *real* fast. (Score:5, Insightful)
You skip all testing. Just the sort of thing I want to install in my system.
Re:Here's how you turn out a patch *real* fast. (Score:5, Insightful)
Re:Here's how you turn out a patch *real* fast. (Score:4, Insightful)
Just make sure you don't let it install that obnoxious ask.com browser bar (in IE and Firefox). I made the mistake of including it in a slipstreamed xp disk and the silent installer took all defaults (browser bar and all).
Wow (Score:5, Funny)
You mean an individual who doesn't have a business to protect or any customers is able to come up with an un-QA'd version faster than the company that produced the product. Amazing!
Security through obscurity (Score:2)
Re: (Score:2)
Apart from the fact that obscurity is not really security at all, why do you think a patch posted to the front page of slashdot and dozens of other places on the net is somehow obscure?
Patch? (Score:2, Interesting)
Articles reading the future? (Score:5, Funny)
What i find more interesting is how slashdot is now able to tell the future!
The article boldly claims that something released yesterday has arrived two weeks before the official patch. Now, i know it's possible that the two weeks was taken from Adobe's projected patch fix date, but projections and fact are still different, and journalistic integrity requires a writer in this situation to indicate directly that this two weeks is not actually fact, as we couldn't know that yet. The headline is an outright lie, as far as i can tell, as it relies on future events being a certain way.
Can we not have articles started with lies on slashdot from now on? Maybe keep the lies towards the end?
-Taylor
Re: (Score:2)
[...] journalistic integrity requires a writer in this situation [...]
Hahahahaha... *gasp* wait, wait, .... HAHAHAHAHAHHAHA!
Re: (Score:2)
*sigh* It's kdawson. What do you expect?
Re: (Score:2)
Yeah, and in this case, kdawson got it right. The patch will be released on March 11th, according to Adobe.
It's my policy to give credit where credit is due. I know kdawson normally SUCKS HORRIBLY, but he owned you and the grandparent here.
DOUBLE KILL!
What are you talking about man? I made it very clear (for people who can't figure it out) that there is a big difference between prediction and fact. You cannot claim something as fact that hasn't happened yet. The headline should have taken that into account. "patch beats adobe's projected release by two weeks" for example.
But, you know, you could just ignore the basic stuff i said and spout of something stupid too, that works.
-Taylor
Re: (Score:2)
Dude, this is /. - "journalistic integrity" means that the ext3 filesystem mounted cleanly. :-P
Re: (Score:2)
Can we not have articles started with lies on slashdot from now on? Maybe keep the lies towards the end?
"Yes"
There's a simple reason for that. (Score:5, Insightful)
As anyone who has developed complex software with a large installed userbase can attest to, you /cannot/ simply slap together a fix and push it out to millions of people.
Even the simplest one line code change change requires extensive (if targeted) testing when you operate on that scale - the consequences of an "oops" that could result from a hasty fix could easily get far worse than the original issue.
Re: (Score:2)
And to prove the point, you have a mistake in your two line comment!
Re:There's a simple reason for that. (Score:4, Insightful)
- the consequences of an "oops" that could result from a hasty fix could easily get far worse than the original issue.
Do you really believe that? I appreciate the need for caution and measured risk taking before releasing new code, but taking _weeks_ to test a reg hack/kill switch just tells me that a company isn't taking their defects very seriously. I'd be much more forgiving of a company that screwed up a patch than one that sat on it until it was too late.
Re: (Score:2)
As for how forgiving you'd be: we'll see if that's still true when tens of thousands of your users suddenly can't open a critical document without crashing or other instability.
It's ultimately a judgment call: they need to decide if getting an urgent patch out is worth the risk that an urgent patch introduces. In the case of a product with this large an installed userbase, and given the fact that this hole has been out there for quite a while already, I think that they took the only responsible cour
Re: (Score:2)
Oh, I believe it. My patch was clean on a large project, but some numbskull didn't have his changes in the source control system and compiled the new version for installation from what was on his desktop, without any of the other previously source control submitted updates. The results.... well, the results weren't pretty because my patch didn't get the full QA procedure as a "minor patch", and because they trusted _my_ code. I continued to get the blame for the situation at meetings with staff for other de
Re: (Score:2)
Or not, it's pretty obvious you aren't actually responsible for a network of any size that people actually have to use and have reliability expectations of.
You're right. I'm not responsible for a network, and my portfolio of applications run on just 8,000 machines. But the data on those machines cannot -- under any circumstances -- be compromised. I'm not talking about the inconvenience of a system-wide outage or a day or two of lost revenue, I'm talking about the inconvenience of the $20B company those 8,000 people work for appearing on the front page of the Wall Street Journal due to a breach. The former might get me fired, but the latter will get them a
Re: (Score:2)
Re: (Score:2)
You can if you're Apple [slashdot.org].
It's been Two Weeks since you made the patch ... (Score:5, Funny)
Lurene Grenier has published a home-brewed patch for the critical Adobe Reader vulnerability ... beating Adobe Systems Inc. to the punch by more than two weeks.
What the fuck Adobe? What did you do for those extra two weeks?
it applies only to the Windows version of Adobe Reader 9.0 and comes with no guarantees.
Oh ... I guess you were trying to make it work on all systems, and checking to make sure that it didn't royally fuck up the user's computer, or introduce another, potentially more serious vulnerability.
Really? (Score:5, Funny)
"caveats that it applies only to the Windows version of Adobe Reader 9.0 and comes with no guarantees."
My boss will be pleased. I can push all my releases up at LEAST two weeks earlier now by adding this caveat on to all of my code. Thanks, Geritol.
Why doesn't anyone think javascript is useful? (Score:5, Interesting)
I used to make slides for talks using LaTeX. There are great ways to include animations directly in the pdf that use javascript. I always had far less trouble getting my animations to play than other people at conferences I went to because acrobat reader was all I needed and it is nearly always there. And for the record, the animations were things I really needed since they showed output from simulations.
I've also seen lots of forms that do some math or validation. How do people think that happens?
Again, I think we need to be very careful about executable code but that doesn't mean there are no possible good uses for it.
Re:Why doesn't anyone think javascript is useful? (Score:4, Insightful)
I'm not sure I understand the overwhelmingly negative reaction to javascript in pdf files.
Please read the 10 immutable laws of security [microsoft.com]. The one you're looking for is the first one on the list:
"If a bad guy can persuade you to run his program on your computer, it's not your computer anymore."
Re: (Score:3, Insightful)
"If a bad guy can persuade you to run his program on your computer, it's not your computer anymore."
Is that referring to Bill Gates?
Re: (Score:2)
If you don't trust bill then no - isn't that what the article says?
Re:Why doesn't anyone think javascript is useful? (Score:4, Funny)
I'm not sure I understand the overwhelmingly negative reaction to javascript in pdf files.
...
There are great ways to include animations directly in the pdf that use javascript.
Hmm.... I think I see a connection here.
Re: (Score:3, Informative)
I like the way Apple approaches that problem in their Quartz Composer tool. Basically you have JavaScript for all types of funky validations, requests and calculations you would like to do but the 'vulnerable' classes that would allow reading/writing local files, networking or creating annoying popups have been removed.
3rd-Party security fixes (Score:2)
Yes, because we should all get our security patches from unknown 3rd-Party sources. Sounds like a plan for success to me.
BTW, I've got this great IE patch, it makes the Internet 10x faster!
A better patch... (Score:4, Insightful)
Good riddance.
Re: (Score:2)
Re: (Score:2)
Foxit supports javascript too now... I suspect the reason it hasn't been attacked is there isn't any blood in the water over some small company.
Good for him... (Score:2)
Re: (Score:2, Funny)
Thank you for letting the Slashdot community know what you find offensive... is this because you think it's interesting, or because you have no friends to talk with?
Re:Offensive (Score:5, Funny)
I'll go for the secret third option, "because she's a feminist". Letting the world know what they find offensive is practically the feminists' national sport. Rather, it would be if they had their own country. And by God, I wish they did.
Re:Offensive (Score:5, Funny)
Q: How many feminists does it take to change a lightbulb?
A: That is NOT funny.
Re:Offensive (Score:5, Funny)
A: Four. One to change the lightbulb, three to form a support group.
But really, it's a trick question because feminists can't change anything.
Re: (Score:3, Funny)
Unrelated to the feminist jokes, but related to lightbulbs:
Q: How many psychiatrists does it take to change a lightbulb?
A: Only one, but the lightbulb has to want to change.
Re: (Score:2)
A: You don't know because you weren't there man!
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Dude, you should really be careful. I don't think you realize who you're talking to. [xkcd.com]
Posting AC is only going to keep you safe for so long.
That also goes for everyone who modded her down.
Re: (Score:2, Insightful)
Ada Lovelace, the first programmer.
http://en.wikipedia.org/wiki/Ada_Lovelace [wikipedia.org]
Re: (Score:3, Insightful)
Your grandchildren are not likely to be browsing Slashdot. Furthermore, taking offense to something that is very clearly tongue-in-cheek is not befitting of someone of your age.
Re: (Score:3, Funny)
Re:Offensive (Score:5, Funny)
Yeah, you're right. It's terrible when people use an apostrophe when they mean "your".
Re: (Score:2)
Yes, but you certainly do not represent the majority of that demographic, so the analogy still stands.
Reply: Adobe to Lurene Grenier (Score:5, Funny)
Adobe to Lurene Grenier: You decompiled Acrobat in some way to create this fix, in violation of click-through license and DMCA (not to mention making us look incompetent.) We're suing you and we're going to make sure your government put you away in a pound-you-in-the-ass prison for a long long time.
Re: (Score:2)
He flipped a REGISTRY VALUE for fuck's sake! WTF kind of proof are they going to give to the judge? Or is this a SLAPP [wikipedia.org]?
Re: (Score:2)
Just like when Dmitry Sklyarov cracked the Rot-13 encryption? ;-)
Seriously, apparently Adobe is not above suing people for depicting the truth^W^W^W making adobe look stupid.
Re: (Score:2)