Critical Vulnerability In Adobe Reader

An anonymous reader writes "Core Security Technologies issued an advisory disclosing a vulnerability that could affect millions using Adobe's Reader PDF file viewing software. Engineers from CoreLabs determined that Adobe Reader could be exploited to gain access to vulnerable systems via the use of a specially crafted PDF file with malicious JavaScript content. Successful exploitation of the vulnerability requires that users open a maliciously crafted PDF file, thereby allowing attackers to gain access to vulnerable systems and assume the privileges of a user running Acrobat Reader."

Comments

For the uninformed:

[Joe Snipe]

Foxit FTW

Re:For the uninformed:

[Ethanol-fueled]

Hey, that's my line. By the way,

While investigating the feasibility of exploiting a vulnerability previously disclosed in Foxit Reader (CVE-2008-1104), a CoreLabs researcher found that Adobe Reader was affected by the same bug.

Foxit users: don't panic. Though Foxit Reader v2.3 build 2825 is vulnerable, 2.3 builds 2912 and later are patched. Build 3309 is the current version available for download.

...with the privileges of a user running the Adobe Reader application.

Which strongly implies that those affected will be Windows users with Administrator access.

Re:For the uninformed:

[JustinOpinion]

Another option for PDF reading on Windows is Sumatra PDF (if you prefer open-source).

Re:For the uninformed:

[Zonk (troll)]

That might work on some or most files, but there still is no replacement for Acrobat.

True, but we're getting closer. OpenOffice 3 now has a PDF Import extension, and of course for Windows there's PDFCreator (Gnome/KDE and OS X natively support printing to PDF).

Re:For the uninformed:

[IngeniousCognomen]

Sure, Foxit is fine as far as it goes, but it runs slower than Adobe Reader on my PC. Plus Adobe lets me save as text, where Foxit expects me to pay for that functionality.

Re:For the uninformed:

[Anonymous Coward]

I knew some guy would chime in recommending Foxit, but I'm surprised and glad to see a recommendation for Sumatra.

Foxit is suffering from its own feature-creep and bloat-up issues (on a much smaller scale than Adobe's software, but still), so Sumatra is really what I _think_ everyone who chimes in with "Foxit" really means to recommend. It accurately renders PDFs. THAT'S IT.

Re:For the uninformed:

[bcrowell]

That might work on some or most files, but there still is no replacement for Acrobat.

Huh? I create PDFs all the time, and don't own a copy of Acrobat. I use pdftex and inkscape, but there's scads of other software that can do it, e.g., Scribus if you want GUI desktop publishing. This is all on linux, but there's tons of PDF-creating software on Windows as well.

Re:For the uninformed:

[Beardo the Bearded]

there's tons of PDF-creating software on Windows as well.

PDFCreator from sourceforge:
http://sourceforge.net/projects/pdfcreator/

It's a Windows printer that prints out your documents as PDFs.

It's that easy.

Re:For the uninformed:

[initdeep]

if you rtfa, you would note that the current build of adobe reader isn't vulnerable either.

Re:For the uninformed:

[c0p0n]

Actually, well before that. But the parent said import.

Re:Single-purpose tools are good

[bcrowell]

Does Adobe Reader come with a "safe mode" with just plain old PDF enabled?

To disable js, go to Edit, Preferences, JavaScript, and uncheck "Enable Acrobat JavaScript".

Even if the js-related security bugs are fixed, it's still a privacy issue, because js in a pdf file can be used to track who's reading a particular document.

Personally, when I see that a piece of software has a long history of security problems, I take that as my cue to remove it from my system. I don't really care that they keep fixing the bugs. The fact that it has this history demonstrates that the software wasn't written with the correct attention to security, and it's likely to have more such problems in the future.

If you're running Linux, xpdf starts up extremely fast, and that's why I use it as my pdf plugin in Firefox. If you want something a little more modern, try evince.

People have posted saying that on Windows, you should switch to Foxit, but the article says that the security flaw was found first in Foxit, and only later in Adobe Reader. I actually tried to get the science division at the community college where I teach to switch to putting Foxit on machines in the student labs as the default pdf plugin. However, when the faculty were testing it, they found that it was not correctly displaying some of the pdfs they were using.

Re:Which again...

[andrewd18]

I create PDF order forms for my company that our salesmen e-mail to customers; these javascript-enabled PDF order forms dynamically enable or disable options as the user customizes an order. For example, if the user picks option A, sub-options A1 -> A5 are automatically enabled, while B1 -> B5 are disabled. And that's why you might want javascript in a PDF.

Re:Which again...

[Nimey]

It raises the question, godsdamnit. Here's what "begging the question" actually means:

http://en.wikipedia.org/wiki/Begging_the_question

How soon we forget best practices

[richrumble]

98% of virii/malware etc need ADMIN to succeed... and very few application on windows, save a very small percentage actually need admin. The User Group is good enough for the wife/kids and my sales staff, lowers TCO even for M$. We don't use installed AV clients, we scan remotely nightly, run proxy+av along with snort, no issues. Users can use runas http://xinn.org/RunasVBS.html if need be, but they probably won't need to. Anti-Admin VS Anti-Virus, and AA wins! http://richrumble.blogspot.com/2006/08/anti-admin-vs-anti-virus.html -rich

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Single-purpose tools are good

[Randle_Revar]

JS in PDFs is silly IMO, but I have to point out that PS (but not PDF) is a Turing-complete language.

http://www.tinaja.com/post01.asp

Re:An alternative?

[cparker15]

Web page?

Re:Single-purpose tools are good

[erikdalen]

Postscript is a stack based programming language. PDF was afaik originally designed to be a simpler format for just describing page layout. But then they've extended it to be able to include javascript for programming and embedding videos, flash and all sorts of stuff (sounds like HTML...).

http://en.wikipedia.org/wiki/PostScript

Scripting is useful, but....

[Anonymous Coward]

Scripting is great, as it allows you to generate dynamic content, perform validation, etc. It enables better PDF presentations and forms and cute little tools. In short, javascript benefits PDF in the same ways it benefits (X)HTML.

However, like macro languages in word processors & like javascript in webbrowsers, scripting in PDF viewers needs to be hardened against unintended consequences.

"No javascript in PDF" is a very poor solution. Few people disable javascript in their browsers. Even the fairly paranoid will just run "noscript" & will then decide (for themselves and on a case-by-case basis) when scripting is desired and trustworthy.