Critical Vulnerability In Adobe Reader

An anonymous reader writes "Core Security Technologies issued an advisory disclosing a vulnerability that could affect millions using Adobe's Reader PDF file viewing software. Engineers from CoreLabs determined that Adobe Reader could be exploited to gain access to vulnerable systems via the use of a specially crafted PDF file with malicious JavaScript content. Successful exploitation of the vulnerability requires that users open a maliciously crafted PDF file, thereby allowing attackers to gain access to vulnerable systems and assume the privileges of a user running Acrobat Reader."

Comments

For the uninformed:

[Joe Snipe]

Foxit FTW

Re:For the uninformed:

[Ethanol-fueled]

Hey, that's my line. By the way,

While investigating the feasibility of exploiting a vulnerability previously disclosed in Foxit Reader (CVE-2008-1104), a CoreLabs researcher found that Adobe Reader was affected by the same bug.

Foxit users: don't panic. Though Foxit Reader v2.3 build 2825 is vulnerable, 2.3 builds 2912 and later are patched. Build 3309 is the current version available for download.

...with the privileges of a user running the Adobe Reader application.

Which strongly implies that those affected will be Windows users with Administrator access.

Re:For the uninformed:

[JustinOpinion]

Another option for PDF reading on Windows is Sumatra PDF (if you prefer open-source).

Re:For the uninformed:

[nine-times]

...with the privileges of a user running the Adobe Reader application.

Which strongly implies that those affected will be Windows users with Administrator access.

It seems fair to worry even if you aren't running as admin. If a trojan PDF can run arbitrary code with privileges of the user running Adobe Reader, that's still enough to screw with that user's documents even if the user isn't an admin.

Re:For the uninformed:

[Zonk (troll)]

That might work on some or most files, but there still is no replacement for Acrobat.

True, but we're getting closer. OpenOffice 3 now has a PDF Import extension, and of course for Windows there's PDFCreator (Gnome/KDE and OS X natively support printing to PDF).

Re:For the uninformed:

[JustinOpinion]

Perhaps, but you can have multiple PDF readers installed. And in terms of security, it's usually best to use the simplest application that will work.

So basically you could use FoxIt or Sumatra PDF to open most PDFs. And then for the rare one that uses some advanced stuff, you can fire up Acrobat. The fact is that most of the stuff that Acrobat supports that other PDF readers don't involves some kind of scripting. And really you shouldn't be running any scripts (even those that are, in principle, sandboxed) unless you have reason to trust them.

So a sensible strategy would seem to be that you open 99% of PDFs with a simpler reader, and only use Acrobat on the few that really need it, and only if the source of the PDF is trustworthy in your estimation.

(Yeah, I know... it's a bit of a pain to have multiple programs that do the same thing. In principle you "shouldn't have to" in the sense that your PDF reader should be secure. But in reality it seems like a reasonable precaution.)

Re:For the uninformed:

[internerdj]

Slower than Adobe Reader? What does it do, steal all the cycles from neighboring computers as well?

Re:For the uninformed:

[Anonymous Coward]

I know you're trying to look smart but export and import aren't the same thing.

Re:For the uninformed:

[Beardo the Bearded]

there's tons of PDF-creating software on Windows as well.

PDFCreator from sourceforge:
http://sourceforge.net/projects/pdfcreator/

It's a Windows printer that prints out your documents as PDFs.

It's that easy.

Single-purpose tools are good

[davidwr]

Does Adobe Reader come with a "safe mode" with just plain old PDF enabled?

If not, it should.

Re:Single-purpose tools are good

[Roland Piquepaille]

Your remark leads to the general question: what business does a document viewer have trying to execute embedded Javascript scripts? a PDF file is essentially a PostScript file, so its content is supposed to be interpreted as a page description and nothing more.

This is reminiscent of Microsoft's "executable" .DOC files that was used to spread viruses around years ago. This is what you get when you try to make a tool too clever for its own good.

Re:Single-purpose tools are good

[bcrowell]

Does Adobe Reader come with a "safe mode" with just plain old PDF enabled?

To disable js, go to Edit, Preferences, JavaScript, and uncheck "Enable Acrobat JavaScript".

Even if the js-related security bugs are fixed, it's still a privacy issue, because js in a pdf file can be used to track who's reading a particular document.

Personally, when I see that a piece of software has a long history of security problems, I take that as my cue to remove it from my system. I don't really care that they keep fixing the bugs. The fact that it has this history demonstrates that the software wasn't written with the correct attention to security, and it's likely to have more such problems in the future.

If you're running Linux, xpdf starts up extremely fast, and that's why I use it as my pdf plugin in Firefox. If you want something a little more modern, try evince.

People have posted saying that on Windows, you should switch to Foxit, but the article says that the security flaw was found first in Foxit, and only later in Adobe Reader. I actually tried to get the science division at the community college where I teach to switch to putting Foxit on machines in the student labs as the default pdf plugin. However, when the faculty were testing it, they found that it was not correctly displaying some of the pdfs they were using.

Re:Single-purpose tools are good

[Thundersnatch]

Sure, JavaScript is pointless in a PDF viewer and should be disabled, but it is worth noting that PostScript itself is a programming language. It has conditionals, functions, loops, etc. I myslef once hand-coded a PostScript program to draw a high-res graph of a particular function for a class back in college. This 1K file basically owned the imagesetter in the print lab for about 45 minutes while it rendered at 1200 dpi.

If I recall correctly, there were even a couple of postscript exploits back in the 1990s that could "brick" Apple LaserWrtiers.

Which again...

[slapout]

...begs the question "Why Does Adobe Reader Need Javascript"??

Re:Which again...

[andrewd18]

I create PDF order forms for my company that our salesmen e-mail to customers; these javascript-enabled PDF order forms dynamically enable or disable options as the user customizes an order. For example, if the user picks option A, sub-options A1 -> A5 are automatically enabled, while B1 -> B5 are disabled. And that's why you might want javascript in a PDF.

Re:Which again...

[Anonymous Coward]

You are part of the problem.

Re:Which again...

[Nimey]

It raises the question, godsdamnit. Here's what "begging the question" actually means:

http://en.wikipedia.org/wiki/Begging_the_question

You can have it, hackers

[Sneftel]

Successful exploitation of the vulnerability requires that users open a maliciously crafted PDF file, thereby allowing attackers to gain access to vulnerable systems and assume the privileges of a user running Acrobat Reader.

The main privileges being the privilege of waiting thirty seconds to view text, followed closely by the privilege of a crashed web browser.

Miserable Retards

[ewhac]

Frankly, this should be actionable. There is no excuse for this stupidity any longer.

When I install a new piece of software, the first place I go is to the preferences panel to see if there are any stupid/broken settings that need to be fixed (or, too often, fixed again after an upgrade). I can't remember which version it originally showed up in, but when I saw the checkbox for JavaScript in Acrobat Reader, my jaw hit the floor.

"Are you people fscking morons? Did you learn nothing from the exploits and problems caused by JavaScript in Web browsers? Hell, forget Web browsers; Microsoft Word became a virus/trojan platform because the Special-Needs Children who apparently design all their software thought it would be tEh k00l to embed macros in what is fundamentally a static document."

Every time some would-be clever person adds a macro language or other executable logic to a document format, the result is "unexpected" worms, viruses, and security breaches. Every God-damned time.

This is not an honest mistake. This is negligent engineering, and someone needs to lose a lot of money over it before the lesson sinks in.

Schwab