Slashdot Mirror
Homemade PDF Patch Beats Adobe By Two Weeks
CWmike writes "Sourcefire security researcher Lurene Grenier has published a home-brewed patch for the critical Adobe Reader vulnerability that hackers are exploiting in the wild using malicious PDF files, beating Adobe Systems Inc. to the punch by more than two weeks. Grenier posted the patch on Sunday with the caveats that it applies only to the Windows version of Adobe Reader 9.0 and comes with no guarantees. Also, PhishLabs has created a batch file that resets a Windows registry key to de-fang the hack by disabling JavaScript in Adobe Reader 9.0, giving administrators a way to automate the process."
We figured that one out in about five minutes. Wrote a quick group policy file and moved on to the next problem.
Thank you for letting the Slashdot community know what you find offensive... is this because you think it's interesting, or because you have no friends to talk with?
When loading a PDF, if Reader sees there's JavaScript that wants to run, Reader pops up a dialog along the lines of, "Hey, this file contains executable code which is, y'know, kind of contrary to the whole concept of a 'document'. Do you want to allow the code to run? [Yes] [[Hell, No]]"
This is the cheesy but mostly effective stopgap solution Microsoft adopted when Word became an infection vector for macro viruses. Unless Microsoft got a patent on it, I don't see any reason why Adobe couldn't also use the same approach.
Schwab
Editor, A1-AAA AmeriCaptions
Seriously, JavaScript? In a PDF file? Why would you do that?
Adobe to Lurene Grenier: You decompiled Acrobat in some way to create this fix, in violation of click-through license and DMCA (not to mention making us look incompetent.) We're suing you and we're going to make sure your government put you away in a pound-you-in-the-ass prison for a long long time.
ELOI, ELOI, LAMA SABACHTHANI!?
JavaScript in PDFs is, and always has been, a bad idea. I started disabling it years ago when it first showed up, and am continually frustrated that it is present, let alone enabled by default. How many PDF exploits have relied on JavaScript? I haven't been counting, but it sure seems like most of the vulnerabilities are either through JavaScript or made much easier to exploit by its presence.
Someone is doubtless going to say that JavaScript is critical to PDFs as a helper for filling in forms. OK, whatever, but perhaps that particular job isn't one that a PDF should be doing.
PDFs started out as a portable means to deliver any arbitrary document to someone else with fair assurance that it would look pretty much identical to both parties. Now Adobe seems to be trying to turn it in to some kind of interactive content delivery platform (substitute your own buzzwords) or something. That's not a path I'd like to trod.
You skip all testing. Just the sort of thing I want to install in my system.
You mean an individual who doesn't have a business to protect or any customers is able to come up with an un-QA'd version faster than the company that produced the product. Amazing!
I'll go for the secret third option, "because she's a feminist". Letting the world know what they find offensive is practically the feminists' national sport. Rather, it would be if they had their own country. And by God, I wish they did.
Your grandchildren are not likely to be browsing Slashdot. Furthermore, taking offense to something that is very clearly tongue-in-cheek is not befitting of someone of your age.
So this patch basically does the equivalent of a user going into the program's settings and disabling the JavaScript execution checkbox? Hmmm, I don't want to post this anonymously, so I'll apply one of my homebrew patches to uncheck the "Post Anonymously" checkbox. Wow, I'm l33t!
What i find more interesting is how slashdot is now able to tell the future!
The article boldly claims that something released yesterday has arrived two weeks before the official patch. Now, i know it's possible that the two weeks was taken from Adobe's projected patch fix date, but projections and fact are still different, and journalistic integrity requires a writer in this situation to indicate directly that this two weeks is not actually fact, as we couldn't know that yet. The headline is an outright lie, as far as i can tell, as it relies on future events being a certain way.
Can we not have articles started with lies on slashdot from now on? Maybe keep the lies towards the end?
-Taylor
Worldwide Military budgets: $2100 billion. Worldwide Space Exploration budgets: $38 billion. Really, world? Really?
As anyone who has developed complex software with a large installed userbase can attest to, you /cannot/ simply slap together a fix and push it out to millions of people.
Even the simplest one line code change change requires extensive (if targeted) testing when you operate on that scale - the consequences of an "oops" that could result from a hasty fix could easily get far worse than the original issue.
Lurene Grenier has published a home-brewed patch for the critical Adobe Reader vulnerability ... beating Adobe Systems Inc. to the punch by more than two weeks.
What the fuck Adobe? What did you do for those extra two weeks?
it applies only to the Windows version of Adobe Reader 9.0 and comes with no guarantees.
Oh ... I guess you were trying to make it work on all systems, and checking to make sure that it didn't royally fuck up the user's computer, or introduce another, potentially more serious vulnerability.
So, you're saying your grandmother couldn't install the patch? Or are you trying to imply that your 13 year old or younger grandchildren are nerdy enough to read slashdot?
"caveats that it applies only to the Windows version of Adobe Reader 9.0 and comes with no guarantees."
My boss will be pleased. I can push all my releases up at LEAST two weeks earlier now by adding this caveat on to all of my code. Thanks, Geritol.
Yeah, you're right. It's terrible when people use an apostrophe when they mean "your".
Q: How many feminists does it take to change a lightbulb?
A: That is NOT funny.
I used to make slides for talks using LaTeX. There are great ways to include animations directly in the pdf that use javascript. I always had far less trouble getting my animations to play than other people at conferences I went to because acrobat reader was all I needed and it is nearly always there. And for the record, the animations were things I really needed since they showed output from simulations.
I've also seen lots of forms that do some math or validation. How do people think that happens?
Again, I think we need to be very careful about executable code but that doesn't mean there are no possible good uses for it.
My patch for Adobe is to uninstall reader and use Foxit instead. I thank those on Slashdot who alerted me of its existence as I have longed for a viable alternative from Adobe crapware for ages. It constantly was popping up windows where I would click "don't show me this again" about issues that were relevant to Adobe but not to me, and it never seemed to remember the setting once I checked on it. Worst designed junk I've ever seen. I've since found that Foxit is considerably faster as well.
Good riddance.
- the consequences of an "oops" that could result from a hasty fix could easily get far worse than the original issue.
Do you really believe that? I appreciate the need for caution and measured risk taking before releasing new code, but taking _weeks_ to test a reg hack/kill switch just tells me that a company isn't taking their defects very seriously. I'd be much more forgiving of a company that screwed up a patch than one that sat on it until it was too late.
Pardon my ignorance, but exactly what other format should one use if one wants to use forms?
In my place of work, a large group of individuals each needs to fill out an annual form. It contains some short-answer questions, and a few that requires a few paragraphs to answer. In the past, they have used... wait for it... Word. Yes, I was forced to boot up Word once a year, to fill out this form. You should see the completely disastrous document that results.
For that reason, I always wished our administrators would have figured out pdf forms. You don't "edit" them, as you say; you fill them in. While there are many complaints to make about Adobe, I don't see the problem with pdf forms. Am I missing something?
Dude, you should really be careful. I don't think you realize who you're talking to.
Posting AC is only going to keep you safe for so long.
That also goes for everyone who modded her down.
Q: How many feminists does it take to change a lightbulb?
A: Four. One to change the lightbulb, three to form a support group.
But really, it's a trick question because feminists can't change anything.
Unrelated to the feminist jokes, but related to lightbulbs:
Q: How many psychiatrists does it take to change a lightbulb?
A: Only one, but the lightbulb has to want to change.
So is this "user supplied" PDF fix an example of how Open Source is More Secure than Closed Source?
OSS users supplied a fix in less than a day, whereas a closed source programmer in some cubicle somewhere will take weeks to do the same. Maybe this would be a fine example to present to the UK Parliament and U.S. Congress, in order to convince them that open source is the best path to follow.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
Ada Lovelace, the first programmer.
http://en.wikipedia.org/wiki/Ada_Lovelace
One to change the light bulb and to post that the light bulb has been changed.
Fourteen to share similar experiences of changing light bulbs and how the light bulb could have been changed differently.
Seven to caution about the dangers of changing light bulbs.
Seven more to point out spelling/grammatical errors in posts about changing light bulbs.
Five to flame the spell checkers.
Three to correct spelling/grammar flames.
Six to argue over whether it's "lightbulb" or "light bulb" ... another six to condemn those six as stupid.
Fifteen to claim experience in the lighting industry and give the correct spelling.
Nineteen to post that this group is not about light bulbs and to please take this discussion to a lightbulb (or light bulb) forum.
Eleven to defend the posting to the group saying that we all use light bulbs and therefore the posts are relevant to this group.
Thirty six to debate which method of changing light bulbs is superior, where to buy the best light bulbs, what brand of light bulbs work best for this technique and what brands are faulty
Seven to post URLs where one can see examples of different light bulbs.
Four to post that the URLs were posted incorrectly and then post the corrected URL.
Three to post about links they found from the URLs that are relevant to this group which makes light bulbs relevant to this group.
Thirteen to link all posts to date, quote them in their entirety including all headers and signatures, and add "Me too"
Five to post to the group that they will no longer post because they cannot handle the light bulb controversy.
Four to say "didn't we go through this already a short time ago?"
Thirteen to say "do a Google search on light bulbs before posting questions about light bulbs"
Three to tell a funny story about their show dog and a light bulb.
One to reply almost immediately saying "First Post !!!!!!"
One to post an ASCII image of the lightbulb.
Three to ask "Wtf is that" because their clients didn't display it as fixed-width.
Seventeen to reply saying that their e-mail client is inadequate and suggest they get Mutt.
One to reply with a perfectly labelled scale diagram of how to change a light bulb correctly.
Thirty-three to reply telling them not to send HTML e-mails or attachments, and why don't they just use Mutt and ASCII art anyway.
Two to ask "but does it run Linux ?".
One to make a comment about the upcoming Microsoft Digital Lightbulb Management 2007 SP2 RGE.
Two to suggest that Apple lightbulbs are superior.
Seventy-five to start a massive off-topic Apple vs Microsoft flamewar.
Forty-two to continue it into a Python vs Perl flamewar.
One lonely poster to unsuccessfully try to start a HP-UX vs IRIX flamewar
One hundred and seventy-eight to respond at various times saying
"Troll!!"
"OMG WTF TROLL !!!!!!one
LOL" "Don't Feed Da Troll!!1", etc...
AND
One group lurker to respond to the original post 6 months from now and start it all over again
Don't fight for your country, if your country does not fight for you.