Slashdot Mirror
Zero-day Exploit in PDF With Adobe Reader
hankwang writes "Security researcher Petko Petkov, who is known for his recent discovery of a vulnerability with Quicktime in Firefox, claims to have discovered an exploit that allows arbitrary code execution when a maliciously crafted PDF document is opened in any version of Adobe Reader. Petkov did not disclose any technical details other than a video, but claims on his blog that Adobe has acknowledged the vulnerability. If this exploit goes wild, it could cause some serious problems, as PDFs are usually automatically opened from web browsers and widely used and trusted by corporate users."
From the blog:
"The vulnerability affects Windows XP SP2 with IE7 and Adobe Reader 8.1, 8.0 and 7. Windows Vista users are not affected."
The Foxit PDF reader is pretty great, and I often recommend it to my clients. Not only will it be a good temporary fix for this exploit, but it opens PDF documents very quickly.
Windows:
http://www.download.com/Foxit-PDF-Reader/3000-2079_4-10634896.html?tag=lst-0-1
Linux:
http://www.foxitsoftware.com/pdf/desklinux/
Foxit Reader is the canonical 3rd-party viewer for Windows: http://www.foxitsoftware.com/pdf/rd_intro.php
Macs have Preview, Linux has Evince and others.
Hail Eris, full of mischief...
E pluribus sanguinem
The entire download is just over 1mb and it loads PDFs quicker than the 40+mb pile of shit known as "reader".
Only the State obtains its revenue by coercion. - Murray Rothbard
It's not a zero-day exploit until Petko releases code for the script kids to use without having a patch/update from Adobe.
"If this exploit goes wild, it could cause some serious problems, as PDFs are usually automatically opened from web browsers and widely used and trusted by corporate users."
If you are using firefox, there is a simple way around this. Just install the PDF download add-on, its also helps avoid the problems involving the embedded PDF plugin crashing your browser.
Mathematics is made of 50 percent formulas, 50 percent proofs, and 50 percent imagination.
You are joking, right? Xpdf lacks all kinds of features useful in the corporate world. Forms that can be filled out is one. PDF is an open format, and Adobe publishes the standard for your convenience, but even after years of work Xpdf and offshoots like libpoppler still can't support much more than they did years ago.
The summary makes me think it is some kind of stack smashing attack; probably an integer overflow. These can occur in the PDF parsing code, before you even have to look at features like scripting. On the other hand, if PDF is anything like PostScript here, and I believe it is, it is a programming language itself, which might lead to exploitable situations.
Also, an integer overflow was recently found and fixed in xpdf. This could be the same bug.
Please correct me if I got my facts wrong.
On the other hand, if PDF is anything like PostScript here, and I believe it is, it is a programming language itself, which might lead to exploitable situations.
No. Postscript is a Turing-complete language. People have, e.g., written calculator programs in postscript, and implemented Conway's game of life in it. PDF is not Turing-complete, and that was an intelligent, intentional design decision. I think it had less to do with concerns about security than with not wanting to run a program on your printer without having any possible way to tell whether the program would ever terminate.
Find free books.
PDFs have long been known as 'landmines of the Internet' for their long load times and the fact so many websites don't mark links as PDF so you never know when you're going to 'trip' over one.
It looks like Adobe is just kicking their reputation up a notch.
Is this a news report or a trailer for a motion picture?
I'm not sure in what sense you use "canonical" here, but I also (and for the third time on Slashdot) highly recommend Foxit Reader. It's so good it actually makes you angry at Adobe for their shitware.
That's what I keep saying. A vulnerability is never zero day. An exploit is only zero-day if an in-the-wild exploit is discovered the same day that the software vendor and security communities become aware of it. Since this was posted as an undisclosed proof of concept three days ago, it is quite impossible for a zero day exploit to exist!
The road to tyranny has always been paved with claims of necessity.
One warning : test Foxit before deploying in a corporate environment. Foxit presumes full access to HKLM to work properly with IE/Outlook/etc..
Other than that, Foxit is a very nice piece of software.
Big! Strong! Wow! Tada-O!
Adobe recently threatened to sue a company that wanted to include PDF output into their word processor.
Yes, that company was Microsoft, but that doesn't change the fact that they threatened to sue them over its inclusion for "antitrust reasons" (read: It would hurt the sales of Acrobat).
PDF isn't an open standard. If you want to implement it, Adobe apparently retains the right to sue you for it at any time.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
As a side note... Preview does an incredibly good job with PDFs that Adobe themselves can't even do. Back when I was a Windows user exclusively, I always complained that the "official" reader was dog slow even on the fastest machines, and could not ever scroll smoothly through any slightly complex document.
Now that I've switched to Mac and use Preview, I realize this isn't Windows, it's just Adobe's incompetence. Preview is fast as hell and NEVER lags in any way, while Adobe Reader for the Mac is as slow and bloated as its Windows brethren.
This was an announcement of a vulnerability that was discovered in Adobe Acrobat. There is nothing 0day about it, and it will not ever and can not ever be a 0day. Period.
The defining characteristic of 0day is the day an EXPLOIT is RELEASED, where such exploit also serves as the ONLY vendor notification of a bug being discovered. Every adult on this list understands the definition, but the kids can't seem to grasp the not-so-subtle nuance between a 0day and the discovery of a bug in someone else's code.
This supposedly serious disclosure referred to in the article is a non-event, there was a "press release" about a supposedly serious flaw in PDF, there were no details, so therefore it doesn't even count as disclosure of a vulnerability as a whole.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
Even better (i.e. MUCH faster): Sumatra PDF http://blog.kowalczyk.info/software/sumatrapdf/
Heh, KPDF has a checkbox for whether you want it to respect that DRM. Um, no thanks. (There's also a compile-time option to make it mandatory, for the wussier binary distros.)
what corporation actually makes use of forms?
Oh, I don't know. This company I work with every year to file taxes uses PDFs which you can download then complete. Perhaps you've heard of them? They're called the IRS.
http://www.irs.gov/formspubs/lists/0,,id=97817,00.html
My State & City also have PDF forms online that you can complete.
Foxit is also vulnerable to this, if you RTFA (including the comments made down in the blog). Its apparently not as bad there since you have to interact some with the document (it won't automatically just run), but I wouldn't advertise it as an alternative to prevent this vulnerability.
Mathematics is made of 50 percent formulas, 50 percent proofs, and 50 percent imagination.