Slashdot Mirror

← Back to Stories (view on slashdot.org)

Adobe Warns of Security Flaw in Reader

Posted by Zonk on from the quick-fix dept.

isusmiley writes "Adobe Systems Inc. issued a warning on its Web site Tuesday saying that the flaw affects only the Adobe Reader versions 5.0.9, 5.0.10, which were written for the Unix computer operating system. Adobe has since posted a fix for the vulnerability on its site, and a spokesman said Wednesday he was unaware of any security breaches resulting from the software flaw, which was discovered by the security defense firm IDefense, headquartered in Reston, Va."

20 comments

  1. Note by Otter · · Score: 2, Funny
    Current versions for Linux and Solaris seem to be OK, anyway. It's the current AIX and HP-UX versions that are bad.

    So much for 2005 being The Year Of AIX On The Desktop!

    --
    What I'm listening to now on Pandora...
  2. Oh good by Dammital · · Score: 2, Interesting
    Adobe's recommendation is to replace their vulnerable version 5 reader with the spyware version 7.

    That's progress. Of a sort.

    1. Re:Oh good by MoonFog · · Score: 2, Interesting

      And even with the spyware, the Linux version is still incapable of opening DRM'ed ebooks, seeing how it appears to be locked in with MS passport.

  3. Just remember... by jd · · Score: 3, Informative
    There is a Layer 7 patch for Linux that will allow you to filter network traffic by application type. You should be able to use an unpatched IPTables to filter anything outbound from acroread anyway, but I'm not sure if this would catch everything that can include Acrobat internally. Either way, you can make it very very hard for Acrobat-based spyware.


    I would also suggest lobbying the UN to have Javascript declared a crime against humantiy, but that might take longer to be effective.

    --
    It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    1. Re:Just remember... by vigilology · · Score: 1

      Could you tell us what patch this is, please?

    2. Re:Just remember... by jd · · Score: 1

      Layer 7 patches

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    3. Re:Just remember... by vigilology · · Score: 1

      Thankyou.

    4. Re:Just remember... by jd · · Score: 1

      Hey, no problem! :) Sorry I didn't have the link in the original post, I'm usually better on doing that.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
  4. I didn't know anyone by VolciMaster · · Score: 1

    was still using versions that old. I've been on 6 and/or 7 (depending on work/home) since they came out and haven't seen the problems mentioned.

    --
    antipaucity
  5. I'll see your flaw, and raise you DRM by hacker · · Score: 4, Interesting
    "Adobe has since posted a fix for the vulnerability on its site, and a spokesman said Wednesday he was unaware of any security breaches resulting from the software flaw..."

    Two words: Show me .

    Prove that the "flaw" exists. Just saying "Clicking on the whatchamacallit causes bad things to happen, please upgrade." isn't enough.

    Show me that this isn't some FUD to force users to upgrade to a version that isn't riddled with the latest DRM that they "forgot" to put into those versions?

    Show me that this version doesn't fix a vulnerability that exposes passwords in PDFs read with it.

    Show me that this isn't more ass-covering by Adobe, again.

    Until then, xpdf, gpdf and other non-Adobe variants are all working fine. Nothing to see here, move along.

  6. I wish more OS's would do what Apple did by white1827 · · Score: 1

    Adobe's reader has turned into this huge bloated mess. The more complicated you make the software, the easier it is to have security holes slip by.
    Apple has great PDF reading and generation that comes free with OSX so you don't have to use the Adobe Reader. It's so nice to have a simple fast loading pdf solution.

  7. Adobe flaw by AdminPrep.com · · Score: 1

    hacker (14635), While I see your point that this could be a great way to have users upgrade to the new version I also see the point of not showing how to exploit the flaw as well. If it is indeed a flaw then I'm sure the flaw has been exposed on the Internet or irc channels. AdminPrep.com

  8. Acrobat alternative by ditto999999999999999 · · Score: 1

    I use Foxit Read (http://www.foxitsoftware.com/pdf/rd_intro.php) as a replacement for Acrobat Reader. It seems to be faster, and that makes me happy.

    Andy

    1. Re:Acrobat alternative by ditto999999999999999 · · Score: 1

      Damnit... there goes my real first name.

  9. A real flaw by SkiifGeek · · Score: 1

    I don't know whether you read the actual details of the flaw, or not. From your response, I doubt that you did.

    Essentially, whenever Reader 5.0.9 or 5.0.10 opens a PDF file, it creates a randomly named duplicate in /tmp which can then be read by other users with the appropriate permissions, which makes it a local file disclosure vulnerability. When the file is closed in Reader, the duplicate created is then destroyed.

    In addition to the recommended upgrade to version 7, there is a version 5.0.11 which addresses this issue, otherwise, nice troll.

    --
    InfoSec that matters, when it counts.
    1. Re:A real flaw by hacker · · Score: 1
      Essentially, whenever Reader 5.0.9 or 5.0.10 opens a PDF file, it creates a randomly named duplicate in /tmp which can then be read by other users with the appropriate permissions, which makes it a local file disclosure vulnerability.

      So in version 7, I see that it creates the temp copy in RAM (mkstmp()), but now its vulnerable to be read in a much different way. On Hyperthreaded processors (i.e. multicore from Intel), since the processor itself has a shared cache, both cores need to be able to read from it. If one core opens the pdf, any process running on the other core can read the contents as they pass across the cache. Oops!

      In addition to the recommended upgrade to version 7, there is a version 5.0.11 which addresses this issue, otherwise, nice troll.

      As others have mentioned, the recommended upgrade also adds some defaults to a new feature that allows the pdf to "phone home" when opened. Sure, 5.0.11 fixes the flaw, but 99% of the users who are asked to upgrade will try to find the latest version they can, and upgrade to that. In this case, that means the "phone home" version.

    2. Re:A real flaw by Magic5Ball · · Score: 1

      If one core opens the pdf, any process running on the other core can read the contents as they pass across the cache. Oops!

      Not a problem specific to Adobe...

      --
      There are 1.1... kinds of people.
  10. Brevity is... by b00m3rang · · Score: 1

    Considering the forum, I'm pretty sure the submitter could have said "UNIX" instead of "the Unix computer operating system".

    Most of us would have figured that one out.

  11. 37MB+ just to open PDFs by anim8 · · Score: 1

    I couldn't believe my eyes when I saw it. I suppose I'll go bakc to using KPDF or KGhostview.

    It's too bad what has become of Adobe. Bloatware + Spyware. It used to be a cool company.