Critical Vulnerability In Adobe Reader

An anonymous reader writes "Core Security Technologies issued an advisory disclosing a vulnerability that could affect millions using Adobe's Reader PDF file viewing software. Engineers from CoreLabs determined that Adobe Reader could be exploited to gain access to vulnerable systems via the use of a specially crafted PDF file with malicious JavaScript content. Successful exploitation of the vulnerability requires that users open a maliciously crafted PDF file, thereby allowing attackers to gain access to vulnerable systems and assume the privileges of a user running Acrobat Reader."

Comments

For the uninformed:

[Joe Snipe]

Foxit FTW

Re:For the uninformed:

[BrennanM3]

That might work on some or most files, but there still is no replacement for Acrobat.

Re:For the uninformed:

[Ethanol-fueled]

Hey, that's my line. By the way,

While investigating the feasibility of exploiting a vulnerability previously disclosed in Foxit Reader (CVE-2008-1104), a CoreLabs researcher found that Adobe Reader was affected by the same bug.

Foxit users: don't panic. Though Foxit Reader v2.3 build 2825 is vulnerable, 2.3 builds 2912 and later are patched. Build 3309 is the current version available for download.

...with the privileges of a user running the Adobe Reader application.

Which strongly implies that those affected will be Windows users with Administrator access.

Re:For the uninformed:

[JustinOpinion]

Another option for PDF reading on Windows is Sumatra PDF (if you prefer open-source).

Re:For the uninformed:

[nine-times]

...with the privileges of a user running the Adobe Reader application.

Which strongly implies that those affected will be Windows users with Administrator access.

It seems fair to worry even if you aren't running as admin. If a trojan PDF can run arbitrary code with privileges of the user running Adobe Reader, that's still enough to screw with that user's documents even if the user isn't an admin.

Re:For the uninformed:

[Zonk (troll)]

That might work on some or most files, but there still is no replacement for Acrobat.

True, but we're getting closer. OpenOffice 3 now has a PDF Import extension, and of course for Windows there's PDFCreator (Gnome/KDE and OS X natively support printing to PDF).

Re:For the uninformed:

[JustinOpinion]

Perhaps, but you can have multiple PDF readers installed. And in terms of security, it's usually best to use the simplest application that will work.

So basically you could use FoxIt or Sumatra PDF to open most PDFs. And then for the rare one that uses some advanced stuff, you can fire up Acrobat. The fact is that most of the stuff that Acrobat supports that other PDF readers don't involves some kind of scripting. And really you shouldn't be running any scripts (even those that are, in principle, sandboxed) unless you have reason to trust them.

So a sensible strategy would seem to be that you open 99% of PDFs with a simpler reader, and only use Acrobat on the few that really need it, and only if the source of the PDF is trustworthy in your estimation.

(Yeah, I know... it's a bit of a pain to have multiple programs that do the same thing. In principle you "shouldn't have to" in the sense that your PDF reader should be secure. But in reality it seems like a reasonable precaution.)

Re:For the uninformed:

[Anonymous Coward]

Last time someone here suggested Foxit here I installed it and saw a nag, minibanner or some other promotion. Can't remember the specifics but Foxit lasted about 5 seconds.

Same deal with Acrobat reader. It nagged me with stupid promotions to download Acrobat Professional from pirate bay, which I eventually gave in to.

Re:For the uninformed:

[IngeniousCognomen]

Sure, Foxit is fine as far as it goes, but it runs slower than Adobe Reader on my PC. Plus Adobe lets me save as text, where Foxit expects me to pay for that functionality.

Re:For the uninformed:

[onitzuka]

OpenOffice has had the ability to export to PDF since OpenOffice 2.x.

Re:For the uninformed:

[Anonymous Coward]

I knew some guy would chime in recommending Foxit, but I'm surprised and glad to see a recommendation for Sumatra.

Foxit is suffering from its own feature-creep and bloat-up issues (on a much smaller scale than Adobe's software, but still), so Sumatra is really what I _think_ everyone who chimes in with "Foxit" really means to recommend. It accurately renders PDFs. THAT'S IT.

Re:For the uninformed:

[internerdj]

Slower than Adobe Reader? What does it do, steal all the cycles from neighboring computers as well?

Re:For the uninformed:

[bcrowell]

That might work on some or most files, but there still is no replacement for Acrobat.

Huh? I create PDFs all the time, and don't own a copy of Acrobat. I use pdftex and inkscape, but there's scads of other software that can do it, e.g., Scribus if you want GUI desktop publishing. This is all on linux, but there's tons of PDF-creating software on Windows as well.

Re:For the uninformed:

[Ephemeriis]

That might work on some or most files, but there still is no replacement for Acrobat.

Depends on what you need Acrobat for...

If all you want to do is view a PDF, you certainly don't need Adobe Reader (which is what the story talks about). There are plenty of perfectly good alternatives out there, and Foxit is one of them.

If you want to create a PDF, you frequently don't actually need Adobe. We've got tons of clients who basically just want to email a simple word/text/whatever document to someone with relative certainty that they'll be able to open it, view it, and print it - but not make changes. These clients are often under the impression that the only software that can possibly do what they want is Adobe. In fact, Foxit and PDFCreator often do what they need.

Sure, if you're looking to embed all sorts of flashy graphics and movies and stuff... Make an editable form... Embed keywords or something... Adobe is the way to go. But for basic stuff, why bother?

Re:For the uninformed:

[the_womble]

That might work on some or most files, but there still is no replacement for Acrobat.

I have had one PDF file so far this year that failed to open in KPDF - and I have not tested if that opens in Acrobat either.

I have never used Foxit, but there are certainly perfectly good, reliable, PDF readers other than Acrobat.

This may not be true if you need a particular feature that is only implemented by Acrobat, for most people the alternatives are as good or better.

Re:For the uninformed:

[Joe Snipe]

I wasn't familiar with sumatra untill you posted, and I have now installed and will give it a run. Thanks for the recommendation!

Re:For the uninformed:

[Anonymous Coward]

I know you're trying to look smart but export and import aren't the same thing.

Re:For the uninformed:

[spud603]

This is exactly what I do in Mac OS X. Virtually always, I just open the PDF with Preview.app (part of the basic OS distribution). On the rare occasion that it won't open or is a form or something, I'll right-click>open with>Acrobat.app. Not much of a pain.
I think it makes good sense to have a different app depending on what you need done. For instance, reading articles in PDF in Preview or Acrobat is a pain, and I'll use Skim.app for those.

Re:For the uninformed:

[Beardo the Bearded]

there's tons of PDF-creating software on Windows as well.

PDFCreator from sourceforge:
http://sourceforge.net/projects/pdfcreator/

It's a Windows printer that prints out your documents as PDFs.

It's that easy.

Re:For the uninformed:

[initdeep]

if you rtfa, you would note that the current build of adobe reader isn't vulnerable either.

Re:For the uninformed:

[Tubal-Cain]

Are the Adobe SpeedLauch apps running in the backgroud? That is the only way I can imagine the 200MB Adobe Reader 9 launching faster than Foxit.

Re:For the uninformed:

[SleepingWaterBear]

The real solution is to open 100% of PDFs in a simpler reader, and refuse to tolerate PDFs that require scripting.

Really, there's no good reason for a document viewer to have the bloat of Acrobat, and we shouldn't encourage Adobe by doing what they want.

Re:For the uninformed:

[Thaelon]

Foxit FTL.

Sumatra PDF Viewer FTW.

Foxit is about as bloated and irritating as Acrobat Reader was in version 5.0 (which was much better, but still terrible).

Sumatra is to Foxit as Foxit is to Adobe Acrobat Reader.

I realize being a .info site makes it very suspicious, but if you don't trust me or it, Google it yourself

Re:For the uninformed:

[Curmudgeonlyoldbloke]

So what? Adobe Reader is where the vulnerability is.

Re:For the uninformed:

[Anonymous Coward]

Ghostscript for the win. It reads PDF files, too, after all.

Re:For the uninformed:

[c0p0n]

Actually, well before that. But the parent said import.

Re:For the uninformed:

[Anonymous Coward]

True. Of course, if they're using Vista, (and haven't turned off UAC - you leave that on right?) the privleges will not include Admin access.

The dodgy code will have to bring up a UAC prompt and convince the user to accept it. Other than that its only the users files affected - the same as any other OS....

- "Please open a terminal window and type 'su '" works just as well.... the only difference is the education of the user.

</STIRRING-SLASHDOT>

Re:For the uninformed:

[5865]

Sumatra PDF did a good job porting the freaking ass slow rendering experience from Linux to Windows. Have you even tried Foxit before you bash it?

Quick test: Load a hundred pages+ PDF and drag the scroll bar across the pages. You should expect Foxit to keep up with your maniacal scrolling followed by Adobe's sub second lag and Sumatra's "Please wait - Rendering...."

But if you mean Foxit under Linux, it's noticeably slow. Just like all the other PDF viewers for Linux.

Re:For the uninformed:

[Gazzonyx]

Especially when someone figures out that the adobe update has to run as an admin...

Re:For the uninformed:

[Spit]

The unprivileged exploit has access to launch further exploits against other system vulnerabilities, which do give privilege.

Re:For the uninformed:

[Anonymous Coward]

So my options are to get pwnt by a cracker or get pwnt by Adobe? I'll take my chances with the cracker.

Re:For the uninformed:

[westyvw]

For the enlightened: Okular FTW

Re:For the uninformed:

[access.name]

Paradoxically, this vulnerability was found in Foxit first :) http://secunia.com/advisories/29941/

Re:For the uninformed:

[Anonymous Coward]

If you rtfa or the summary you will see nothing specifying that this is a windows exploit. Not that I use Acrobat or Reader on my mac anyway. Most of the pdf's I get are made from 3D AutoCad files and Reader chokes when trying to print them anyway. Apple's Preview opens and prints them just fine though.

Re:For the uninformed:

[ZosX]

I second that. Print to PDF is so amazingly handy it makes you wonder why nobody thought if it sooner. It should also be a good workaround for the people that have problems with how open office tends to drop fonts in pdfs.

Re:For the uninformed:

[tsa]

But who uses the current build of AR? AR 8.0 is a disaster and the reason I switched to Foxit. I guess the versions after 8.0 are not better.

Re:For the uninformed:

[steelcaress]

Yeah, I've hated Acrobat since about 5.0, and then I found Foxit. :) Foxit even opens multiple PDFs in tabs, and does support some pretty advanced stuff (to my surprise). Life's good.

Re:For the uninformed:

[Dr_Barnowl]

ECHELON? Isn't that where the government searches for words like bomb, plutonium, assassinate, and anarchy?

It's also triggered by laundering black-bag fissionable toffee for Bugs Bunny.

Re:For the uninformed:

[Krneki]

I agree, and it's damn fast too.

Re:For the uninformed:

[Anonymous Coward]

Thanks a lot, it's what I've been looking for when working on Windows.

Re:For the uninformed:

[Anonymous Coward]

depending on what you are doing, you may want to be able to respect the color profiles embedded in the pdf... ... and afaik only acrobat can reliably use them.

Re:For the uninformed:

[LittleGuy]

That might work on some or most files, but there still is no replacement for Acrobat.

Paper printout?

Re:For the uninformed:

[atamido]

This is exactly what I do in Mac OS X.... I'll right-click...

There is a good joke in there somewhere.

Re:For the uninformed:

[Ash Vince]

That might work on some or most files, but there still is no replacement for Acrobat.

Why not? Foxit works treat for me. I have not yet found a PDF that it cannot open, even the encrypted ones I have been sent. It is also smaller and faster than the adobe software so runs better on old PC's like mine.

Re:For the uninformed:

[spud603]

heehee. fair enough.
but with the advent of the new portables there's no Apple computer made anymore that doesn't easily and natively support right click.
(but in Apple's you-don't-ever-need-a-second-mouse-button world, they expect you to use File>Open with>Acrobat or just drag the icon to acrobat somewhere. Matter of preference, I guess)

Re:For the uninformed:

[Anonymous Coward]

Why is the post by c0p0n posted at 3:34 marked as informative, while the post by Tubal-Cain half an hour previous is marked redundent?

Normally the redundent would make sense the other way around..... unless the person marking redundent is referring to the +5 funny post by AC, but Tubal-Cain's post is only a minute after the AC, so him and the AC would have been writing their posts at the same time and unaware of one another.

Somebody fix this.

Re:For the uninformed:

[c0p0n]

Dude, you take slashdot way too seriously...

Re:For the uninformed:

[RockDoctor]

But who uses the current build of AR? AR 8.0 is a disaster and the reason I switched to Foxit. I guess the versions after 8.0 are not better.

Substitute "5.05" for "8.02 and you'll be getting closer to my experience.
Once Acrobat removed the capability for me to export the text of a PDF to a text file without having to pick up a mouse and plug it in, then I stopped downgrading to newer versions. Now that I'm occasionally (under 1%) seeing PDFs generated with image types that aren't recognised, then I'm having to look at other programs. FoxIt solved that particular problem, but I don't know if I'll replace AR 5.05 with FoxIt in my re-install set, yet.

Structural Issues

[Anonymous Coward]

Critical Vulnerability In Adobe

You see, if you mix too much water into the mixture before it hardens, it is brittle and your dwelling will collapse on you ...

Re:Structural Issues

[Anonymous Coward]

I don't understand your building analogy. Please use a software architecture instead.

Re:Structural Issues

[azgard]

In terms of software architecture, it's like mixing of too much Turing completeness into this particular DSL.

Re:Structural Issues

[Homr Zodyssey]

It's kind of like a car...

Re:Structural Issues

[Anonymous Coward]

Nonono, we use car analogy here.

Symptoms you've been attacked

[Anonymous Coward]

Adobe Reader is very slow to load and freezes your browser. Yes, it's very difficult to tell.

Single-purpose tools are good

[davidwr]

Does Adobe Reader come with a "safe mode" with just plain old PDF enabled?

If not, it should.

Re:Single-purpose tools are good

[Roland Piquepaille]

Your remark leads to the general question: what business does a document viewer have trying to execute embedded Javascript scripts? a PDF file is essentially a PostScript file, so its content is supposed to be interpreted as a page description and nothing more.

This is reminiscent of Microsoft's "executable" .DOC files that was used to spread viruses around years ago. This is what you get when you try to make a tool too clever for its own good.

Re:Single-purpose tools are good

[Rary]

Does Adobe Reader come with a "safe mode" with just plain old PDF enabled?

If not, it should.

Agreed. And the same goes for every other application primarily designed to read documents (images, media files, whatever).

On the one hand, I find some of the functionality that is being embedded in various document types useful, but on the other hand I find it ridiculous that data can attack us.

Re:Single-purpose tools are good

[zalas]

They've already developed a lite version of their PDF renderer for their Digital Editions product, so they really should just distribute the renderer in that as a standalone product or something.

Re:Single-purpose tools are good

[bcrowell]

Does Adobe Reader come with a "safe mode" with just plain old PDF enabled?

To disable js, go to Edit, Preferences, JavaScript, and uncheck "Enable Acrobat JavaScript".

Even if the js-related security bugs are fixed, it's still a privacy issue, because js in a pdf file can be used to track who's reading a particular document.

Personally, when I see that a piece of software has a long history of security problems, I take that as my cue to remove it from my system. I don't really care that they keep fixing the bugs. The fact that it has this history demonstrates that the software wasn't written with the correct attention to security, and it's likely to have more such problems in the future.

If you're running Linux, xpdf starts up extremely fast, and that's why I use it as my pdf plugin in Firefox. If you want something a little more modern, try evince.

People have posted saying that on Windows, you should switch to Foxit, but the article says that the security flaw was found first in Foxit, and only later in Adobe Reader. I actually tried to get the science division at the community college where I teach to switch to putting Foxit on machines in the student labs as the default pdf plugin. However, when the faculty were testing it, they found that it was not correctly displaying some of the pdfs they were using.

Re:Single-purpose tools are good

[nine-times]

And it should also be the default mode, IMO.

But I guess I never got the memo that explained why Acrobat Reader was doing anything more than reading plain/static PDFs in the first place. Didn't they do something in new versions to allow Flash and movies, or something?

The only reason I use PDFs is when I want to make a document with a very controlled layout, both in print and on a display, without any expectation of editing. Honestly I'm willing to pay money to Adobe to get Acrobat if it's going to help me do that in a way that's proven, robust, and configurable. I can also understand the desire for things like comments and digital signatures, but anything much more than that and I feel like it's just shoehorning extra bloat in the form of features that relatively few people will use, probably at the expense of security and possibly at the expense of sanity.

Re:Single-purpose tools are good

[jmulvey]

"they really should just distribute the renderer in that as a standalone product or something."

Yes. Because we should soon expect the renderer installer alone to consume an entire 4 GB DVD. Adobe Acrobat is the pinnacle of bloatware. No wonder vulnerabilities like these are discovered. It must be easy to poke holes in the 17 gajillion lines of code it takes Adobe to render text.

Re:Single-purpose tools are good

[HTH NE1]

To disable js, go to Edit, Preferences, JavaScript, and uncheck "Enable Acrobat JavaScript".

Under Edit : Preferences I just have General, Comments, Full Screen, and Weblink.

Help : About Acrobat Reader says it's Acrobat Reader 5.0, x86 linux 5.0.10 Nov 8 2004 13:14:17.

Re:Single-purpose tools are good

[bcrowell]

it's Acrobat Reader 5.0, x86 linux 5.0.10 Nov 8 2004 13:14:17.
You're running an extremely old version. The current version is 9.

Re:Single-purpose tools are good

[Randle_Revar]

JS in PDFs is silly IMO, but I have to point out that PS (but not PDF) is a Turing-complete language.

http://www.tinaja.com/post01.asp

Re:Single-purpose tools are good

[Thundersnatch]

Sure, JavaScript is pointless in a PDF viewer and should be disabled, but it is worth noting that PostScript itself is a programming language. It has conditionals, functions, loops, etc. I myslef once hand-coded a PostScript program to draw a high-res graph of a particular function for a class back in college. This 1K file basically owned the imagesetter in the print lab for about 45 minutes while it rendered at 1200 dpi.

If I recall correctly, there were even a couple of postscript exploits back in the 1990s that could "brick" Apple LaserWrtiers.

Re:Single-purpose tools are good

[erikdalen]

Postscript is a stack based programming language. PDF was afaik originally designed to be a simpler format for just describing page layout. But then they've extended it to be able to include javascript for programming and embedding videos, flash and all sorts of stuff (sounds like HTML...).

http://en.wikipedia.org/wiki/PostScript

Re:Single-purpose tools are good

[HTH NE1]

it's Acrobat Reader 5.0, x86 linux 5.0.10 Nov 8 2004 13:14:17.
You're running an extremely old version. The current version is 9.

You think that's old? You should look up xemacs 19.13. Also, the installed mozilla version:

% /usr/lib/mozilla-1.2.1/mozilla-bin --version
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20030225, build 2003022516

I can't even run Firefox 3 on my work system. I have to run it on the only Linux machine here that can, displaying to my screen, and even then it keeps spitting out Gdk- and Gtk-CRITICAL assertion errors.

Re:Single-purpose tools are good

[Anonymous Coward]

maybe they should give sumatra pdf a go instead http://blog.kowalczyk.info/software/sumatrapdf/

Re:Single-purpose tools are good

[Anonymous Coward]

Why use forms in PDF? Why not host the forms in HTML format on a centralized server? Or on a laptop running an AMP stack for people doing door to door customer hunting?
I believe there are solutions to avoid passing around documents with embedded scripts.

Re:Single-purpose tools are good

[de Siem]

hold shift, when launching reader, it disables all plugins on launch.

Re:Single-purpose tools are good

[Anonymous Coward]

Hey, why don't you go and assume you know about our business and what we should be doing. Fuck off.

Re:Single-purpose tools are good

[hyc]

Bricking a laserwriter wasn't hard at all.

I remember when someone posted their implementation of John Conway's "Life" to usenet. That was a fun way to tie up a printer and waste a ream of paper. (Basically you could prepend it to any document and it would iterate off the document's first page. Each generation printed on a separate page.)

Re:Single-purpose tools are good

[Geoff-with-a-G]

People have posted saying that on Windows, you should switch to Foxit, but the article says that the security flaw was found first in Foxit, and only later in Adobe Reader.

Well, being the first one to find and fix the vulnerability is still a pretty good endorsement. Few useful software products out there have zero flaws. You should put your trust in those that find, disclose, and resolve their flaws in a speedy and reliable manner.

Which again...

[slapout]

...begs the question "Why Does Adobe Reader Need Javascript"??

Re:Which again...

[andrewd18]

I create PDF order forms for my company that our salesmen e-mail to customers; these javascript-enabled PDF order forms dynamically enable or disable options as the user customizes an order. For example, if the user picks option A, sub-options A1 -> A5 are automatically enabled, while B1 -> B5 are disabled. And that's why you might want javascript in a PDF.

Re:Which again...

[TrekkieTechie]

Because there's really no more efficient way of introducing security exploits which necessitate expensive upgrades to the latest version.

I'm sorry, did I say 'expensive'? I meant 'profitable' -- Freud strikes again!

Re:Which again...

[Anonymous Coward]

for the same reason why God needs a starship

Re:Which again...

[TimeTraveler1884]

"Why Does Adobe Reader Need Javascript"??

I've written scripts for Adobe Acrobat Professional to interleave PDFs of scans from my single-duplex, automatic document feeder scanner. Can you believe that there are companies out there that charge $100 or so to do the same task with a plugin? Took me 15 min to write it in JavaScript myself.

As far as Reader though, I've seen some web-fill state tax forms that use Javascript for field validation.

Re:Which again...

[Anonymous Coward]

Hence the source of a simple solution ... I disable it, along with a bunch of other plugins that are useless to me.

One of the followup replies notes that Javascript is useful to embed logic in forms. That's great, and a justifiable use. It makes sense.

So, if I ever do encounter one of those forms rather than a plain document, I'll temporarily re-enable it. (Hasn't happened yet)

The real question is, why is Javascript turned on by default when most documents don't need it?

Re:Which again...

[betterunixthanunix]

ghostscript for the win. I can do this in even less time using ghostscript and reasonably advanced shell. The best part is not having to pay for Acrobat pro.

Re:Which again...

[Anonymous Coward]

You are part of the problem.

Re:Which again...

[Nimey]

It raises the question, godsdamnit. Here's what "begging the question" actually means:

http://en.wikipedia.org/wiki/Begging_the_question

Re:Which again...

[Randle_Revar]

Thank you!

Re:Which again...

[__aawkdb2598]

I twitch almost every time I see "begs the question" but I've given up on saying anything. I applaud your enthusiasm :D

Go team!

Re:Which again...

[ZERO1ZERO]

Yeah. I noticed that. I understand when not to use 'begging/begs the question' when meaning 'raises the question' . But I have read that wiki page before, and I just read it again, but it still makes no sense to me. Can someone please explain in plain english when one *would* use the phrase begging the question?

"That begs the question" is an appropriate reply when a circular argument is used within one syllogism. That is, when the deduction contains a proposition that assumes the very thing the argument aims to prove; in essence, the proposition is used to prove itself, a tactic which in its simplest form is not very persuasive.

I mean, what the fuck?

Re:Which again...

[Anonymous Coward]

Assume Adobe would not suck. They would not deliver a buggy, intrusive and horribly bloated software as a document reader. Software without bloat and bugs is good. Therefore Adobe does not suck.

That begs the question.

Re:Which again...

[Nimey]

Another way of putting it is "circular logic". You start off by making an assumption, then use logic to prove that assumption, which is vacuous because you didn't prove it, you instead used circular logic.

Re:Which again...

[Anonymous Coward]

even when i couldn't see your reply, somehow i knew what it would say.

Re:Which again...

[syousef]

It raises the question, godsdamnit. Here's what "begging the question" actually means:

Originally you're correct. The common idiom has changed to reflect a more intuitive meaning. Language changes over time. YOU are the one failing to deal with it.

Re:Which again...

[Anonymous Coward]

Simple English wikipedia to the rescue?

Re:Which again...

[ZERO1ZERO]

Well knock me down with a feather.....

Re:Which again...

[noidentity]

It needs Javascript because PDFs include Javascript code. Duh! Now, let's see what this "begging the question" is on that Wikipedia page...

Re:Which again...

[MyLongNickName]

From your link:

"More recently, to beg the question has been used by some to mean "to raise the question", or "the question really ought to be addressed". [7] An example of such a use would be, "This year's budget deficit is half a trillion dollars. This begs the question: how are we ever going to balance the budget?" Although proponents of the traditional meaning will criticize this formally incorrect usage, it has nonetheless come into widespread use and in informal contexts may actually be the more common use of the term. The phrases circular reasoning, circular logic, and circular arguments have come to be used in places where logicians would tend to use "beg the question"."

So, it would appear that language changes over time.

Re:Which again...

[Anonymous Coward]

Incorrect usage by the ignorant does not constitute "language change".

Re:Which again...

[Just Some Guy]

The example that made sense to me was the question: "do you still beat your wife?" The question itself presumes that you did in fact beat your wife at one time.

Re:Which again...

[Anonymous Coward]

Here here! :)

Re:Which again...

[Anonymous Coward]

Incorrect usage by the ignorant does not constitute "language change"

Yes it does. You think the only way languages change is by Royal decree???

You can have it, hackers

[Sneftel]

Successful exploitation of the vulnerability requires that users open a maliciously crafted PDF file, thereby allowing attackers to gain access to vulnerable systems and assume the privileges of a user running Acrobat Reader.

The main privileges being the privilege of waiting thirty seconds to view text, followed closely by the privilege of a crashed web browser.

Re:You can have it, hackers

[QuantumG]

hehe, people use to say that about the overflow in the default php install for apache. "oh, you can only get access to the 'anonymous' account on the web server". There's always a dozen different local exploits you can use to escalate from these accounts. And that's on a platform which actually takes security seriously.

Re:You can have it, hackers

[Sneftel]

Er, yes, I got that. And there's no need for escalation, as the user most likely has pretty good system privileges, not to mention access to all his own documents.

'twas a joke, you see.

Re:You can have it, hackers

[QuantumG]

A lot of people sandbox Acrobat Reader on Linux and IE7 does it too I think.

Oh, and I meant the 'nobody' account. Wow, it has been years.

Re:You can have it, hackers

[jonaskoelker]

Or >90% usage of mem and swap. Happens to my office mate's box. She is not happy, but she managed to run top on it once to identify the culprit. I think she's switching to kpdf [she doesn't like the ubuntu orange].

Re:You can have it, hackers

[CamD]

You mean you are actually able to view text? And I thought it was a privilege to wait thirty seconds for a partial interface of some sort to display, followed by a crashed web browser.

Out of curiosity...

[vishbar]

Why in the world does Adobe Acrobat include a Javascript engine in the first place? Why add a structured programming language to a document? HTML is different since it's being used as a new platform for applications...but a PDF file? Maybe I'm missing something. Have any of you ever used Javascript in a PDF document (other than when you're trying to access a remote machine)?

Re:Out of curiosity...

[Anonymous Coward]

PDF supports forms among other things, and javascript can be used in the same way it is used in HTML.

Re:Out of curiosity...

[avandesande]

But why? It would have been a great and ubiquitous tool if it had stuck with being a wrapper for postscript- anything else 'extra' that acrobat does is done better some other way.

Re:Out of curiosity...

[Randle_Revar]

I guess after they took Turing-completeness out of PS to make PDF, they wished they hadn't, and somehow thought JS was better than PS.

Re:Out of curiosity...

[janwedekind]

Don't know why they included it. However I've seen PDF documents with buttons and forms. There's even a style file for pdflatex called pdfanim which allows you to do animations with Javascript in your PDF document. However I noted that it behaves slightly different under GNU/Linux and Microsoft Windows.

Adobe 8.1.2 is old

[Anonymous Coward]

This version is from February of this year and there have been numerous releases since, including version 9 - which are not vulnerable.

Yep.

[Shade of Pyrrhus]

This was discussed previously, as well - the difference is that a specific vulnerability has been found at this point.

As usual, take precautions to ensure you're not automatically opening PDFs in your browser - Save by default instead, so you can scan it and actually make the decision to open it yourself.
For Firefox users:

Tools->Options->Applications. Change actions for PDFs to Save.

Just disable javascript

[Anonymous Coward]

That's what I did from the start. The thing is, Acrobat doesn't seem to like that, because it prompts me to enable it, twice, every time I open a document. It's pathetic, really.

Re:Just disable javascript

[ewhac]

Since when did it start prompting you to turn on JavaScript? (Mind you, I haven't upgraded past Acrobat Reader 6.0, since I didn't see the point.)

Schwab

Noscript

[glop]

Hey,

I can't believe nobody mentioned that noscript prompts you before showing a PDF file.

It can be tedious but it's useful apparently.

Re:Noscript

[Randle_Revar]

when I click on a pdf, SeaMonkey asks me what to do, and I either save it or open it in evince

How soon we forget best practices

[richrumble]

98% of virii/malware etc need ADMIN to succeed... and very few application on windows, save a very small percentage actually need admin. The User Group is good enough for the wife/kids and my sales staff, lowers TCO even for M$. We don't use installed AV clients, we scan remotely nightly, run proxy+av along with snort, no issues. Users can use runas http://xinn.org/RunasVBS.html if need be, but they probably won't need to. Anti-Admin VS Anti-Virus, and AA wins! http://richrumble.blogspot.com/2006/08/anti-admin-vs-anti-virus.html -rich

Re:How soon we forget best practices

[Joe The Dragon]

No live AV scanning there is stuff out there that does not need admin to take over the system.

Just wait for your kids to play games with DRM, auto updating, online play, mods and more that needs admin to work.

Re:How soon we forget best practices

[richrumble]

Not much, BHO's like Vundo(virus) only work against IE, we don't use IE. There is very little. I've got 2000+ users who are never infected, again no IE. -rich

Re:How soon we forget best practices

[cbhacking]

So true. Nonetheless, I find running my main account on XP as a standard user to be a real pain sometimes. There are things, like the control panel, that are... awkward... to start as a limited user.

For things like this, Vista's UAC - say what you will about it training people to click OK or whatever (you can configure it so it demands your password every time, like Linux or OS X, if that's preferable) is really actually quite handy. After a few months of running XP as a standard user, UAC was an incredibly wonderful feature.

You can't secure a stupid user who owns the computer, but you can make things a LOT less irritating for a smart user who wants to run securely. Runas is a bloody pain.

HATE Adobe

[Forty Two Tenfold]

What I hate about them most is their labeling the file types in windows: "Adobe PDF, Adobe SVG, Adobe PNG". WHAT THE FUCK! This should be prosecuted.

Re:HATE Adobe

[Ed Avis]

There's precedent: look for 'Microsoft HTML Document'.

Is this hole cross platform compatible?

[Biff Stu]

Adobe is one of the best when it comes to cross-platform compatibility and the hole is based on Javascript...

And yes, I did RTFA.

Re:Is this hole cross platform compatible?

[Anonymous Coward]

Most of the reader javascript codebase will be shared. I'd say most probably yes, the bug will affect adobe pdf reader versions on all platforms. However, exploitation techniques are different on different platforms.
If there is no way to bruteforce offsets, then an attacker has only 1 shot (unless the user keeps reopening a crashed pdf file). Note that it might in fact be bruteforceable if the adobe pdf reader fails safe after a failed exploit attempt.

Re:Is this hole cross platform compatible?

[Anonymous Coward]

Adobe sucks. Macromedia was the best. PDF and also Java (sans 'script') are the worst software packages ever designed in the world.

Comment removed

[account_deleted]

Comment removed based on user account deletion

An alternative?

[ArchieBunker]

Can you suggest an alternative for creating and using interactive forms?

Re:An alternative?

[slapout]

Perhaps an interactive form program. But not one called Adobe _READER_

Re:An alternative?

[cparker15]

Web page?

Re:An alternative?

[slimjim8094]

How about not a display format? PDF is PostScript without the logic...

Just use a website if that's what you want your form to act like.

Re:An alternative?

[erikdalen]

A HTML page using javascript?

Probably doable in a spreadsheet as well.

Re:An alternative?

[Geoff-with-a-G]

Web page?

Yeah, those never have javascript.

Starting off with the requirement of having customers fill out customized forms, we have explored two options:
1. Send them PDFs with some javascript, have them fill it out and send back
2. Build a secure Internet facing website which incorporates the same business logic as the javascript from the PDFs.

In theory we're trying to avoid adding unnecessary complexity and possible security vulnerabilities to a simple application. You really think option 2 meets that goal better than option 1?

Re:An alternative?

[Just Some Guy]

In theory we're trying to avoid adding unnecessary complexity and possible security vulnerabilities to a simple application. You really think option 2 meets that goal better than option 1?

Yes, since web browsers were designed with the explicit goal of doing this sort of thing. Quoth Einstein: "Make things as simple as possible, but not simpler." It appears as though your system is too simple.

Note to Adobe...

[JAZ]

You're doing wrong.

So what?

[Anonymous Coward]

Who runs this app as root anyway?

Yes

[WD]

Yes, it affects Adobe Reader on all supported platforms.

Adobe is taking the piss

[Anonymous Coward]

I know this has either already been said, or will never be seen, both due to Slashdot's advanced "post in the first 30 seconds or no one will ever read your shit" moderation system but PDF exploits are starting to take the piss. It seems that every month there's a new PDF exploit in the wild and if my virus checker throws up a blocked object while I'm surfing 9 times out of 10 its a PDF.

I wonder how many people have been rootkited by a PFD exploit while surfing the net only to proclaim "OMGWTF windows / IE sucks balls" Adobe needs to pull its fucking finger out, and I need to install an OSS PDF reader.

Scripting is useful, but....

[Anonymous Coward]

Scripting is great, as it allows you to generate dynamic content, perform validation, etc. It enables better PDF presentations and forms and cute little tools. In short, javascript benefits PDF in the same ways it benefits (X)HTML.

However, like macro languages in word processors & like javascript in webbrowsers, scripting in PDF viewers needs to be hardened against unintended consequences.

"No javascript in PDF" is a very poor solution. Few people disable javascript in their browsers. Even the fairly paranoid will just run "noscript" & will then decide (for themselves and on a case-by-case basis) when scripting is desired and trustworthy.

Re:Scripting is useful, but....

[Obfuscant]

"No javascript in PDF" is a very poor solution.

No javascript in pdf is an excellent solution. It's a DOCUMENT, not a video game or word processor or anything else. You don't get javascript on a paper printout; you don't need javascript in the electronic version of a paper printout.

Few people disable javascript in their browsers.

I do. Most javascript in web pages is useless and needless and a waste of computer cycles. If you want to calculate something, do it on YOUR SEVER and send me the result.

It's a crutch used by poor web designers to add glitz to content-less pages.

I caught a major cell-phone company using javascript to provide log-in security for their account access web pages. Since I had javascript turned off, I had access to anyone's account I wanted. I told them what I was doing and they didn't believe it, until I started telling the account manager I was talking to what his minute balance and last payment was. THEN he got interested.

... scripting in PDF viewers needs to be hardened against unintended consequences.

Much better that pdf authors spend the time properly identifying their documents with title and author information. I have US Government produced pdfs where the "title" of the document is "Microsoft preview -- C:\some\file\name\that\is\meaningless.doc" and the author is even stupider. Leave out the fancy crap until you can properly identify your documents, ok?

You need evidence that javascript on web pages is useless? Try Yahoo. I go to my Yahoo mail page and a big, time-wasting page tells me that I have javascript turned off, click here for the OLD version of mail -- which is exactly where I was trying to get to in the first place, damn it!

And get off my lawn...

Re:Scripting is useful, but....

[lahvak]

No javascript in pdf is an excellent solution. It's a DOCUMENT, not a video game or word processor or anything else. You don't get javascript on a paper printout; you don't need javascript in the electronic version of a paper printout.

Except that PDF document is not always an electronic version of a paper printout. Many use it that way, but I think that's actually pretty dumb. It is an electronic document, not an electronic version of a paper document. That makes a lot of differences. If a document is primarily intended for reading on screen, you want to design it differently than one thats intended for print. Page size, font, etc. And there is nothing wrong about giving the reader an option to interact with the document in some way, for example give them a way to emphasize certain parts of an illustration, manipulate a 3d CAD object etc.

I agree with you that 99% of web pages use javascript in a totally stupid way. I also browse with javascript off. However, as a math teacher I like the possibility to embed a Java applet in a page, and give user the possibility to interact with it using elements on the page.

Re:Scripting is useful, but....

[inline_four]

Do you use Google Maps? Do you find AJAX use in that situation unnecessary?

Re:Scripting is useful, but....

[CrazedSanity]

Javascript, or scripting of any other sort, should be BANNEd in PDF documents. PDF means Portable Document Format. Not dynamic. Not editable. Sure, it is nice to be able to edit a PDF directly and save it, but scripting within the document is too much feature creep. Almost as retarded as having a router hijack the user's internet connection to sell software.

I'll admit, the ability to view a 3D image within a document (turning it and such) has very cool possibilities... but don't call it PDF. Don't bloat something with more than it needs. Use something that matches those goals more closely, or come out with a new document type so users aren't confronted with something they're not prepared for...</soapbox>

Re:Scripting is useful, but....

[Anonymous Coward]

i'm with you, gramps

Re:Scripting is useful, but....

[easyTree]

Javascript, or scripting of any other sort, should be BANNEd in PDF documents. PDF means Portable Document Format. Not dynamic.

Paraphrasing 'We fear change' *

* Disclaimer: Abode Arcobat sucks because it's maximum-strength bloatware (so bloated it warps the space-time continuum) and so *it* should be banned; not javascript or any kind of productivity enhancer.

Re: For the ones who did not RTFA

[Anonymous Coward]

Quote from the article: "While investigating the feasibility of exploiting a vulnerability previously disclosed in Foxit Reader (CVE-2008-1104), a CoreLabs researcher found that Adobe Reader was affected by the same bug."

Adobe? Kemosabe? Eh tu Brutus-Tonto?

[ImitationEnergy]

I don't believe anyone has a hack free computer system so this Adobe vulnerability (main article) doesn't surprise me. I don't have the bucks rigth now to update my antivirus but I cranked it up in Task Manager to a higher level than other files. It seems to be doing a good job. Sometimes I'll go to a website and Internet Explorer freezes. When I close it all the open IE windows ar shut down with it, so I suspect it's the antivirus clampling them all down so I have to start fresh. I can't update the IE either since Windows stopped doing that. I'm planning to get a separate Linux Asus Eee in a couple months, take this one offline more. The big monitor uses way too much electricity. The Eee will pay for itself in about 10 months of reduced electric bill vouchers.

Miserable Retards

[ewhac]

Frankly, this should be actionable. There is no excuse for this stupidity any longer.

When I install a new piece of software, the first place I go is to the preferences panel to see if there are any stupid/broken settings that need to be fixed (or, too often, fixed again after an upgrade). I can't remember which version it originally showed up in, but when I saw the checkbox for JavaScript in Acrobat Reader, my jaw hit the floor.

"Are you people fscking morons? Did you learn nothing from the exploits and problems caused by JavaScript in Web browsers? Hell, forget Web browsers; Microsoft Word became a virus/trojan platform because the Special-Needs Children who apparently design all their software thought it would be tEh k00l to embed macros in what is fundamentally a static document."

Every time some would-be clever person adds a macro language or other executable logic to a document format, the result is "unexpected" worms, viruses, and security breaches. Every God-damned time.

This is not an honest mistake. This is negligent engineering, and someone needs to lose a lot of money over it before the lesson sinks in.

Schwab

Re:Miserable Retards

[lahvak]

There is nothing wrong with the concept of scriptable document. The main difference between an electronic document and a paper document is that an electronic document is viewed on the screen, which gives you a lot of possibilities. Having an option to interact with the document, for example to highlight or hide certain part of an illustration or a diagram, etc.

There is, or *should* be, a fundamental difference between document macros as found for example in MS Office, but also used by other software into some extent (e.g. vim modelines), and a scripting language embedded in a document reader. Macros are supposed to help editing and creating the document. For that they usually have access to everything your wordprocessor, spreadsheet or editor can access, including your filesystem. A scripting language in a document viewer should be able to modify the way the document is displayed. That's it, there is no reason for it to access the filesystem or the network. That is where Adobe messed up big time.

Re:Miserable Retards

[Anonymous Coward]

"I can't remember which version it originally showed up in, but when I saw the checkbox for JavaScript in Acrobat Reader, my jaw hit the floor.

"Are you people fscking morons? Did you learn nothing from the exploits and problems caused by JavaScript in Web browsers? Hell, forget Web browsers; Microsoft Word became a virus/trojan platform because the Special-Needs Children who apparently design all their software thought it would be tEh k00l to embed macros in what is fundamentally a static document."" - by ewhac (5844) on Thursday November 06, @02:15AM (#25657293) Homepage

Which is why I have been recommending that folks turn off javascript in Adobe Acrobat Reader here:

----

HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, + make it "fun-to-do", via CIS Tool Guidance (& beyond):

http://www.tcmagazine.com/forums/index.php?s=04c738547f09da1b78b5dcf5c4241e56&showtopic=2662&st=25&start=25

----

On that page of that guide, specifically? It shows other exploits in the past taking advantage of this & via the same mechanisms that 95% of today's exploits use in webbrowsers &/or email programs as well: JAVASCRIPT (the "bane of the internet" (yes, it can be useful, but it is also a 'double-edged sword' that can work against you & anyone looking over @ SECUNIA.COM or SECURITYFOCUS.COM can easily verify this statement of mine, as for the past 1-4 yrs. now or so, 95% of the attacks out there today use javascript to do their dirty deeds...)

====

"This is not an honest mistake. This is negligent engineering, and someone needs to lose a lot of money over it before the lesson sinks in." - by ewhac (5844) on Thursday November 06, @02:15AM (#25657293) Homepage

Agreed... today's browser makers speeding up javascript processing, prior to securing it is, also - they're only speeding up how fast you can be infected via javascript misuse really is why I state that. Facts (such as the infection vector used in 95% of today's attacks online use javascript after all, & just going to SECUNIA.COM &/or SECURITYFOCUS.COM can show anyhow, that much, easily... to bear my statement out as fact, I recommend anyone do so in fact!)

Personally?

As far as webbrowsers &/or email programs go??

It boggles the MIND that devs of those tools haven't yelled to high heck about the vulnerable/weak DOM behind javascript, because of all the exploits being put on others via its usage on "every site under the sun a user goes to". They should default it to off, & when a user needs it?? Websites usually let them know to turn it on, anyhow. I only use javascript on banking &/or shopping (commerce) sites online, where it IS needed + required mostly & that is it - I also have not been infected/infested by any form of malware because of it (& other points in the guide above) in more than 15 yrs. online now.

Not too long ago here, when devs were discussing scripting? I noted this & was modded down for it (wtf?) here:

http://developers.slashdot.org/comments.pl?sid=994291&threshold=-1&commentsort=0&mode=thread&no_d2=1&cid=25362703

& all I was doing was telling the truth + how it is... but, also, how to stay safe vs. it, there... blew my mind, being "modded down" for just telling the truth & also for telling others how to stay safe(r) vs. its misuse.

You also get another "bonus" (for speed this time) in turning off javascript usage in webbrowsers (not just for security) - more speed, by not processing its scripts & also loading in data from yet more servers to do so (as in the case of adbanners, which also have been attack mec

??Bogosity alert?

[lpq]

So why would I want javascript running in my Adobe Reader? I've never had it enabled by default in any browser -- and only enable it in a per-site basis when needed. Adobe Reader...that's something I use to read static "Portable Documents" (like books) that are formatted in "Portable Document Format". I've never needed javascript enabled in any book I've ever read. Am I missing something? I just say 'no' to javascript being 'on' as a 'default' option (or activeX, or 'java'). Wasn't there some rich guy who said if you let untrusted others run programs on your computer then its not your computer anymore?

Re:For the uninformed: there is an "off" switch

[lpq]

Why complicate your life with multiple readers....sure, if you really want to -- especially if you _like_ their interface better, but for the supposed sake of security? On a feature that should be off most of the time anyway? With more readers on your system, you have more 'active code' that your computer is regularly exposed to -- isn't there a risk with an increased code base? Sure, Adobe Reader would be more likely to be attacked than other pdf readers, but it's probably 'tested' by a few more users every day.

But um,..."portable documents"...they are like books -- why would you turn "on" scripting in the 1st
place in adobe reader? I've never found a need for it. Ever. Then again maybe I'm not downloading gyrating pdf's either....? *shrug*...dunno.

Not surprised.

[janopdm]

To clarify, we are talking about a freaking document reader whose updates include a photo album, a electronic book organizer, photography online services, media player, form designer, electronic cards, javascript engine , autoupdater, quicklaunch agent, and probably a dozen fetures that I don't know because I uninstalled the damn thing the moment it asked for .5Gb of updates.

This had to happen because it is bloated software made by people with a bloated mindset. A tool should do one thing and do it well. I'll update you if I need something else.

Re: Microsoft HTML

[lahvak]

Actually, that makes sense. What Microsoft software produces is not HTML. Calling it Microsoft HTML makes a clear distinction. Although "garbage" may be more appropriate.

Seriously

[hesaigo999ca]

Again...another one...seriously??
seriously????
All you have to do with this tool is read a file in one format....come on people.
We aren't asking you to create a new operating system. Get right already!

simple online pdf

[IsaacD]

print to postscript, then visit http://ps2pdf.com/ easy as pie, and free

Re:OOo PDF import plugin For the uninformed:

[denis-The-menace]

The Sun's OOo PDF import plugin does not import in to writer, only Impress and Draw.

IOW: you can only do small changes. If you want to add a paragraph and push everything down, sorry. You'll have to move the content from page to page, manually!

ergh

[revxul]

"Critical Vulnerability In Adobe Reader" Yeah it's called horrible, horrible programming.

Figures

[Anonymous Coward]

Two things that have continually fucked up my computer, consistently, time after time after time for decades: PDF and Java

Two of the biggest piece of shit software packages in the world.

Core Security Vulnerability Advisory

[CoreSecurity]

Here's a link to the actual Core Security vulnerability advisory on the CoreLabs homepage: http://www.coresecurity.com/content/adobe-reader-buffer-overflow .

WHICH macros?

[argent]

Macros are supposed to help editing and creating the document. For that they usually have access to everything your wordprocessor, spreadsheet or editor can access, including your filesystem

Macros that are provided from OUTSIDE the document, yes.

Macros EMBEDDED IN a document must NOT be granted any rights to modify any state outside the currently in-memory copy of that document... and a saved copy IF you choose to save it.