Adobe Confirms Unpatched PDF Backdoor

50Mat writes "Adobe has fessed up to a dangerous code execution vulnerability affecting software programs installed on millions of Windows machines. The flaw, publicly disclosed more than three weeks ago, could allow hackers to use rigged PDF files to take control of Window XP computers with Internet Explorer 7 installed. It affects Adobe Reader, Adobe Acrobat Standard, Professional and Elements and Adobe Acrobat 3D."

Comments

plus about running into this on Vista

[dioscaido]

If it's also vulnerable on IE7 + Vista, luckily IE7 runs with such limited privileges that the code execution won't be able to do anything other than writing to the internet temp folder. That is, if you haven't turned off UAC.

Not a backdoor

[Anonymous Coward]

From the information available, this is just yet another security vulnerability.

A backdoor is an intentional feature that one puts so that they can take over you computer.

Re:solution

[Victor Antolini]

Oh, I missed to point out what you missed. From http://www.foxitsoftware.com/pdf/rd_intro.php

Foxit Reader itself is free. As to add-ons, the critical add-ons are free while advanced add-ons are non-free. For example, you can use the following functions for free:

* View or print PDF document
* Basic PDF form operations i.e. filling out PDF forms and printing them out
* Advanced PDF form operations, such as saving filled-out forms and import/export forms, free for personal usage only
* View PDF as text
* Critical add-ons, such as UI language package, JPEG2000/JBIG decoder, CJK package, GDI+ for early Windows version, etc

The followings are several examples of non-free, advanced add-ons:

* Foxit Reader Pro Pack is not free. It includes the following functions:
o Annotation
o Text viewer and text converter
o Form filler
o Spell checker
o Advanced editing tools, including loupe tool, measure tools, image tool, file attachment tool, link tools, annotation selection tool, and more

Actually without Pro Pack, you are still able to annotate a PDF document and print it out. However when you save the annotated document, it will be stamped with an evaluation mark on the top-right corner of the annotated pages. If you purchase a Pro Pack add-on, then there will be no evaluation mark.

Re:What About Foxit?

[darkmeridian]

Foxit has a related vulnerability that requires user interaction to run the arbitrary code. The Adobe version, of course, runs the arbitrary code without the vulnerability. You could say that Foxit doesn't have the same vulnerability but it comes from the same flaw.