Slashdot Mirror
Adobe Acrobat JavaScript Execution Bug
QASec.com writes to mention that Stefano Di Paola and Giorgio Fedon discovered an unpatched vulnerability in Adobe Acrobat Reader that can allow an attacker to execute arbitrary JavaScript on any hosted PDF file. People are reporting different results based on browser and Acrobat versions. Most of the major sites discussed have already fixed the problem, but many smaller sites may still need to be patched.
Adobe Acrobat JavaScript Execution Bug
So that's what happened to Saddam the other day... now it all makes sense.
The theory of relativity doesn't work right in Arkansas.
I sure have been seeing alot of javascript bugs lately,5 0219
http://it.slashdot.org/article.pl?sid=07/01/01/13
WulframII - Free Online Mutiplayer 3D Tank Shooting Game
i know some people that are gonna get pranked tonight.
how do they find these things?
Does this also affect Foxit reader, or is this just exclusive to Acrobat?
The good: It can't remote root your webserver. .pdf.
The bad: It can make your webserver appear to be hosting arbitrary content if you are hosting any PDF files and the user is using Acrobat reader.
The solution: Delete every PDF file hosted by your webserver OR configure your httpd to throw nasty errors for any requests that contain a string after the
Think of the Children; Sleep with your Sister
Does this affect Preview on OS X too? After all, pratically all OS X users will use Preview to view PDF files (since Preview comes with OS X, and OS X itself has a PDF renderer built-in, at least from what I've read/understood).
The bug is that the Acrobat Reader runs the JavaScript.
Sites are "fixing" this by implementing work-arounds on the server to refuse serving the file if the script is tacked onto the URL. But these are kluges, stop-gap measures to reduce the damage until a proper patch can be made. The sites are not vulnerable; the reader is.
People are never as simple as their stereotypes. This applies equally to Christians, Muslims, and Emacs-lovers.
I'm using Acrobat 8 and Firefox 2, and the acrobat plugin displays "This operation is not allowed" when I clicked the pdf link with javascript. Maybe everyone should upgrade their Acrobat reader.
The story doesn't tell which versions are hit. Is it the latest version (8)?
Crow T. Trollbot
It's typical that they don't mention any work around. I'll be the first to put one up; first open up a command prompt then run
chmod -x `which acrobat`
rpm --erase acrobat
rpm --install xpdf
there, couldn't be simpler. If you find these commands don't work on your system, you either need to use the "apt" command instead of "rpm" or upgrade your operating system. If you are running OpenBSD and you've managed to install and run acrobat then you don't need my instructions.
Nothing at all happens (other than the PDF opening)... so Vista and Acrobat 8 seem immune.
Why did these villains publicize an unpatched exploit? Why didn't they go through normal channels?
I question the timing. What are they trying to prove, by doing this? They must be trying to profit from it.
Oh, wait, this is about Adobe and not Apple. Nevermind.
Clear, Dark Skies
Pardon me, but I am just sick of all this javascript nonsense. While the goal is notable, the design REALLY needs to be rethought and redone, from scratch. But this time with security in mind. It's quite clear that the original designers didn't have a clue about security. And the current batch, I'm sad to say, still doesn't take it seriously.
Yes, I know that those are strong words. But there has never been a secure implementation of anything where security was an afterthought, and bolted on later. Javascript is no exception.
Javascript has well shown that its approach can be very useful. But honestly, right now it seems almost as problematic as Microsoft Windows, when it comes to security issues. Frankly, the Open Source community really ought to be doing better here.
This is (IMHO) the biggest problem with the current implementation of all the Web 2.0/AJAX approaches. And until it's PROPERLY addressed, we're going to see a continual repeat of security issues, just like we see with MS Windows. It's not new; people have been saying this for years. And we still keep seeing these problems.
Pardon the rant, but I really do get tired of seeing this stuff when it should never have happened to begin with.
>Most of the major sites discussed have already fixed the problem,
.pdf files as mime type "application/octet"
>but many smaller sites may still need to be >patched.
This is a client side problem. The worst part is... that the part of the URL after the hash is never sent to the server (which in what holds the malicious code) so there is little that can be done on the server side.
One possible work around on the server side:
Direct your web server to serve
That way the files will be saved to disk instead of opening in the browser plug in.
What the fuck is with this bullshit that posting ANONYMOUSLY still cancels out any moderations you have made? Oh, and better still, those points are wasted forever instead of being given back to you (which is what "Undone" like it fucking says would imply).
This also being discussed at sla.ckers.org along with a useful suggestion for keeping yourself safe from a lot of these type vulnerabilities.
I recently signed up for the "send your name to wherever" thing pointed out on slash (its in my comment history somewhere)
The PDF was formed with parameters linking to a second pdf base document.
From Firefox on Windows with internet explorer disabled the pdf opened inside acrobat then proceeded to display the resulting PDF file in internet explorer.
I haven't seen IE now for ages and that made me nervous as hell.
liqbase
-- Trinity in high heels carrying a whip: The donimatrix - there is no spoonerism
There is no way to patch this on the server side since this is a client side vuln in adobe reader. BTW I posted this story and never said that :)
Please?
I should find where I had saved the firefox extension development SDK and learn it.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The exploit works like this:
a lert(123);
http://[URL]/[FILENAME].pdf#something=javascript:
Strings after # are not sent to the webserver. That is all client-side.
If you ever do decide you want Acrobat again, you'll have to run the Adobe Acrobat Reader 7.0 installer. And then four more installers to climb up the versions from 7.0.1 through 7.0.8 or whatever it is now. And then the final installer to fix this vulnerability.
Or you can find the 5.0 version somewhere, from happier days. Somebody at Adobe really has their head up their ass.
Given how bloated Acrobat Reader had become, I had already stripped out half the plug-ins and disabled Javascript within Reader anyway. It is rarely used and it was an obvious accident waiting to happen, security wise.
Remember, IE uses an ActiveX interface to load Acrobat Reader, while Firefox and Opera use the Netscape-style plugin interface. If the plugin interface is vulnerable, but the ActiveX interface is not, that would explain why it works with Firefox and Opera but not IE.
Also, as others have pointed out, Adobe Reader 8 appears to not be affected.
We should all be safe then considering nobody seems to know how to script in javascript
They may as well, seeing as they've posted no real Apple bugs to date.
Up, Up, Down, Down, Left, Right, Left, Right, B, A, START
Every time I install Acrobat Reader, I dive through the preferences panel and fix all the incorrect defaults. One of the things I turn off, and which should be off by default, is JavaScript execution. Whether turning this off will protect against the described vulnerability, I don't know, but it's probably a reasonable first line of defense.
A lot of the factory-default settings in Acrobat Reader are (stupidly) wrong. You should review all of them.
Schwab
Editor, A1-AAA AmeriCaptions
Yes Acrobat linux seems to be vulnerable to this and in this case we have no way to upgrade to version 8 as it is not available for linux yet. Switching off javascript in the preferences fixes the problem and fortunately, unlike under windows, the application doesn't come up with the message about the lack of javascript crippling functionality.
Or rather, the way you install them is.
The main difference between this and a Firefox Extension is the Firefox makes you wait a few seconds and then click on the "I want to do something really stupid" button. Adobe figures that most people don't care, and presses the "I want to do something really stupid" button FOR you.
My experience as a system administrator is that the only way to get people to quit pushing the "I want to do something really stupid" button, is to make it more inconvenient to jump through the hoops and push the button than to download the file and launch it from the desktop or shell.
Firefox is nearly there.
It was addressed back in the '90s. It's called client-side Java.
Not really; over the last decade, people have found numerous security holes, not only in Sun's implementation, but also in the underlying Java design.
Maybe if the start-up problems in the VM are addressed, client-side Java will return
I think J2SE is far too bloated for that. But J2ME/MIDP might make a good basis for reviving applets.
You can be clever and read local files of unwitting users...
My server
I don't like Adobe and don't want any of their garbage on my system. GIMP is a "good enough" image editor for non-professionals, and FoxIt works great for PDFs. But there is no replacement for Flash, and too many web sites require it.
I installed my extra copy of Windows XP 32 in VMWare so that I could run Flash for GooTube videos. I won't run Adobe programs outside a sandbox.
Melissa
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
There's a lot of missing information here.
1. What context does the js execute in? Browser or Acrobat? If Acrobat, does it have access to your cookies? (I'd guess not)
2. What versions/browsers are affected? I'm using FF2 with Acrobat 5, and nothing seems to happen, but this could be because I've got an odd setup.
Anyone know?
Novell/SuSe, as always, was the first to remove xpdf in favor of Acrobat Reader (there is *More* to acrobat than the reader ;)), which is closed source, but luckily you can't go ahead and accidentially print PDFs with the no-print bit set. Phew.
And at about the same time, Novell/SuSE started running portable dot Net from the init scripts and "Registering IL executables". While Mono was funded.
Need more proof to understand that Novell is dead for the linux community?
I don't read ACs: If a post isn't worth so much as a nom de plume to its author then I wont bother either.