Slashdot Mirror
Adobe Acrobat JavaScript Execution Bug
QASec.com writes to mention that Stefano Di Paola and Giorgio Fedon discovered an unpatched vulnerability in Adobe Acrobat Reader that can allow an attacker to execute arbitrary JavaScript on any hosted PDF file. People are reporting different results based on browser and Acrobat versions. Most of the major sites discussed have already fixed the problem, but many smaller sites may still need to be patched.
I sure have been seeing alot of javascript bugs lately,5 0219
http://it.slashdot.org/article.pl?sid=07/01/01/13
WulframII - Free Online Mutiplayer 3D Tank Shooting Game
Does this also affect Foxit reader, or is this just exclusive to Acrobat?
The good: It can't remote root your webserver. .pdf.
The bad: It can make your webserver appear to be hosting arbitrary content if you are hosting any PDF files and the user is using Acrobat reader.
The solution: Delete every PDF file hosted by your webserver OR configure your httpd to throw nasty errors for any requests that contain a string after the
Think of the Children; Sleep with your Sister
The bug is that the Acrobat Reader runs the JavaScript.
Sites are "fixing" this by implementing work-arounds on the server to refuse serving the file if the script is tacked onto the URL. But these are kluges, stop-gap measures to reduce the damage until a proper patch can be made. The sites are not vulnerable; the reader is.
People are never as simple as their stereotypes. This applies equally to Christians, Muslims, and Emacs-lovers.
I'm using Acrobat 8 and Firefox 2, and the acrobat plugin displays "This operation is not allowed" when I clicked the pdf link with javascript. Maybe everyone should upgrade their Acrobat reader.
It's typical that they don't mention any work around. I'll be the first to put one up; first open up a command prompt then run
chmod -x `which acrobat`
rpm --erase acrobat
rpm --install xpdf
there, couldn't be simpler. If you find these commands don't work on your system, you either need to use the "apt" command instead of "rpm" or upgrade your operating system. If you are running OpenBSD and you've managed to install and run acrobat then you don't need my instructions.
Pardon me, but I am just sick of all this javascript nonsense. While the goal is notable, the design REALLY needs to be rethought and redone, from scratch. But this time with security in mind. It's quite clear that the original designers didn't have a clue about security. And the current batch, I'm sad to say, still doesn't take it seriously.
Yes, I know that those are strong words. But there has never been a secure implementation of anything where security was an afterthought, and bolted on later. Javascript is no exception.
Javascript has well shown that its approach can be very useful. But honestly, right now it seems almost as problematic as Microsoft Windows, when it comes to security issues. Frankly, the Open Source community really ought to be doing better here.
This is (IMHO) the biggest problem with the current implementation of all the Web 2.0/AJAX approaches. And until it's PROPERLY addressed, we're going to see a continual repeat of security issues, just like we see with MS Windows. It's not new; people have been saying this for years. And we still keep seeing these problems.
Pardon the rant, but I really do get tired of seeing this stuff when it should never have happened to begin with.
I recently signed up for the "send your name to wherever" thing pointed out on slash (its in my comment history somewhere)
The PDF was formed with parameters linking to a second pdf base document.
From Firefox on Windows with internet explorer disabled the pdf opened inside acrobat then proceeded to display the resulting PDF file in internet explorer.
I haven't seen IE now for ages and that made me nervous as hell.
liqbase
-- Trinity in high heels carrying a whip: The donimatrix - there is no spoonerism
The exploit works like this:
a lert(123);
http://[URL]/[FILENAME].pdf#something=javascript:
Strings after # are not sent to the webserver. That is all client-side.
Remember, IE uses an ActiveX interface to load Acrobat Reader, while Firefox and Opera use the Netscape-style plugin interface. If the plugin interface is vulnerable, but the ActiveX interface is not, that would explain why it works with Firefox and Opera but not IE.
Also, as others have pointed out, Adobe Reader 8 appears to not be affected.
Every time I install Acrobat Reader, I dive through the preferences panel and fix all the incorrect defaults. One of the things I turn off, and which should be off by default, is JavaScript execution. Whether turning this off will protect against the described vulnerability, I don't know, but it's probably a reasonable first line of defense.
A lot of the factory-default settings in Acrobat Reader are (stupidly) wrong. You should review all of them.
Schwab
Editor, A1-AAA AmeriCaptions