Slashdot Mirror
Adobe Chided For Insecure Acrobat Reader
The Register covers security firm Secunia calling out Adobe for its insecure distribution practices with regard to Adobe Reader. (Here is Secunia's note.) The accusation is that the way Adobe provides Reader extends the software's window of vulnerability once an exploit has begun to circulate. Version 9.1 of Reader, which is what you get when you visit the official download site, contains 10 vulnerabilities that were patched by later releases. "Adobe Systems has been taken to task for offering outdated software on its downloads page that contains dozens of security vulnerabilities, several of which are already being exploited in the wild... Visitors who obtain Adobe Reader from the company's official downloads page will find that it installs version 9.1 of the program on their computers, even though the most recent version was 9.1.2 at time of writing. That could put users at considerable peril given the number of vulnerabilities fixed in the two iterations that have come since 9.1, complains Secunia..."
There's a version without vulnerabilities?
Just about every binary distribution on windows is doing something similar these days. Short of someone building a proper, open, distributed, secure package manager for windows, they're probably doing the best they can by having updates at all. It's better than having to go check the webpage for corrections.
That said, if this kind of complaint becomes more common, and all software is seen as flawed in this regard, then it'll be a great push towards proper package management on windows.
Adobe Reader has always been bad for this - even back when it was called Acrobat Reader.
Aside from having dozens of different versions installed - whatever version you installed was always out of date, unless you started it up(which took ages), and clicked the Check for Updates button. Then it'd tell you you're out of date. You download an update, it restarts, and then you do it again... and it downloads another update. It installs the update, and restarts, and then you do it a third time to check for another update.
After all, jumping from 8.1 to 8.1.3 is much too large of an increment. Each version must be applied incrementally, and it's completely illogical to download every required update at the same time.
Ahh... the fond memories! It takes me right back. Now I remember their artificially slow installers, that did nothing for minutes on end just because of your OS. Such pleasant times!
Dont use Acrobat... There are several alternatives available all less bloated:
GPL'd PDF reader: http://blog.kowalczyk.info/software/sumatrapdf/index.html
Commercial: http://www.foxitsoftware.com/pdf/reader/
I can't think of anything witty right now
People who are downloading Adobe deserve what they get. There are PDF readers on the net that download in 1/10th the time, use less than 1/10th of the resources, run faster, with more features, and WITHOUT the vulnerabilities. Most are free for personal use, most have features that can be unlocked by upgrading, and even the upgraded version can be had for "free" through the advertising schemes. If all a person ever needs to do is read a document published on the web, he doesn't even NEED any features.
It's been years since I installed Acrobat or Adobe reader, and I'll never install it again.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Why are Adobe offering the old versions?
Absolutely! I'm not html guru but surely it shouldn't take a company with Adobe's technical knowhow to update an "a href" tag . . . in fact, come to think of it, I would do it myself for a small fee . . .
I thought by now everyone got the point that Acrobat Reader is a bloated crashware and have switched to Foxit or other alternatives. I'm not saying Foxit is more secure (I don't really know), but I thought that the abomination that emanates from Acrobat Reader has shrank their marketshare so much that any security issues it may have, would be irrelevant.
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
That depends on the difference between 9.1 and 9.1.2. If the difference is a week or two (i.e. the bug fixes haven't been out long) then it's not unreasonable to have a delay updating the download (although it would obviously be better to update it as well rather than distribute known vulnerabilities). If the difference between them is several months or more then it's less excusable and they've had plenty of time to update it.
evince linux: doesn't work with USPS "clik to ship" postage.
acrobat 9 linux: works with "clik to ship".
Sorry.
So... how many months is no longer "a slight delay" in your books?
FoxIT Reader.
http://www.foxitsoftware.com/pdf/reader/
You feel sleepy. Close your eyes. The opinions stated above are yours. You cannot imagine why you ever felt otherwise.
google docs opens pdf's
No, no, no!
It's "you'll need to download a PDF reader".
pdfreaders.org even has free icons which you can use to replace the more usual Adobe-based PDF icons.
Why doesn't the gene pool have a life guard?
Adobe began using javascript in their reader beginning with v7 and that has opened up this whole new world of security issues. Wouldn't it be better if the 'reader' just rendered a static file and didn't run embedded script?
If they make a really secure program, who is going to replace the FSA (Russia) and NSA (USA) subsidy payments?
If the difference is a potentially system crippling exploit, it's not excusable. No matter how new or old. That's like saying having the Linux-kernel 2.4.11 a bit longer out for download wouldn't have been so bad either.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
But ... but all those nifty features, like filling out forms and such! How did we ever survive without them?
It's like saying "Why do we need Aero?" We don't. Few people do at all. But, hell, how do you plan to sell a new version if your markedroids can essentially only say "Well... it has rounded corners now"?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Okay, so there are two conditions: time and criticality. Still, the fact that it is "only" 9.1.0 to 9.1.2 doesn't mean that it shouldn't be updated, but if it is a short period since the patch release and it is a minor patch then the company may have website update policies that mean the new download is pushed to the web server later than the patch.
In my opinion, the purpose of a PDF reader is to ... wait for it ... *read* a PDF file, not run Java or any other sort of scripting. If a publisher wants to create an interactive program, *there are programming languages for that!* If Acrobat Reader was made to specifically prevent a document from doing anything except *being passively read*, we wouldn't have half these problems.
The Swiss Army Knife approach only works for Switzerland's military elite, not software companies!
"My country, right or wrong; if right, to be kept right; and if wrong, to be set right." --Senator Carl Schurz (1872)
That depends on the difference between 9.1 and 9.1.2. If the difference is a week or two (i.e. the bug fixes haven't been out long) then it's not unreasonable to have a delay updating the download
A week or two? Really!? An hour or two maybe. Worst case scenario: Until 8:00AM Monday if the patch was made 5:00PM Friday. Never longer.
If I had so many vulnerabilities I would feel insecure too.
Dewey, you fool! Your decimal system has played right into my hands!
Looks like you struck a nerve!
Does it have self esteem issues?
Adobe's problem of distributing out of date software highlights a bigger problem in the software industry - patch management.
It is an absurd situation when you must go through a patch cycle MULTIPLE times to get your software to a current state. Microsoft and Adobe are horrible at this.
Install a fresh copy of Windows, or Adobe's creative suite and count how many times you must run the updater until it reports that you are current and that there are no further updates to apply. Usually the number hovers around 3 or 4 times. Most non-technical users will assume that the machine is up to date after the first go around. This results in vulnerable machines running around the internet.
Contrast Microsoft's/Adobe's/Apple's stupid approach to my Ubuntu machine. One update run is all that is needed to bring the entire machine up to date.
The major software manufacturers must know this is an issue. I can only assume that they don't give a shit.
-ted
Adobe began using javascript in their reader beginning with v7
Really? I have Adobe Acrobat v5 (for compatibility testing), and it has the javascript engine (and javascript can be disabled in the preferences).
Anyone have Acrobat v4 handy?
... having a pointer to the vendor's download URLs for a file. This is a lot easier, but still requires some added infrastructure and bandwidth. However, third party utilities like Secunia's PSI are able to hunt down and point out outdated/insecure versions, so it wouldn't be too onerous for a central switchboard for application vendors to have one place for update checking. ...
Not a bad idea. But perhaps the infrastructure already exists. It seems like much of this could be a TXT record in a DNS file. Microsoft would only have to host the "root" server for windows software update info. Why create a new infrastructure/protocol when a perfectly good one exists?
Now before you all go and beat up on the idea, I am sure there would be some decisions that would need to be made. For example, does the TXT record actually go in the current zone file, or is this a separate system just using the same protocol? I am sure there are others...
McFly777
- - -
"What do people mean when they say the computer went down on them?" -Marilyn Pittman
I guess there are some "super elite" things to do with Adobe Reader that I have no clue about.
No there aren't. Adobe's just continuing its tradition of producing bloatware.
- Guy who works with PDFs a lot and recommends Foxit Reader.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Ok, i will move my vote over to the totally stupid column.
Just downloaded the 25.5MB reader.
Then downloaded the 26.1MB in updates!
So they appear to have you download one version and then replace it :/
Having it download the downloader probably doesn't simplify anything for Joe Sixpack either. Trying to download Acrobat Reader gives a warning message about installing something that is not Acrobat Reader...Didn't we try to teach Joe NOT to do that?!?
Acrobat is like a giant virus on every machine I've run it on.
SumatraPDF is much, much faster and better.
Besides Adobe is a Fox news sponsor. Don't give them your money or your ram!!!
http://portableapps.com/de/apps/office/sumatra_pdf_portable
I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.
That is a good idea. DNS is tried and true and is made to handle distributed queries on a massive scale. It wouldn't take too much adaptation to have it have some cryptographic verification, and multiple locations for a software product to be updated from. One can also add versioning. Then, a simple client on the PC side could just check executable versions, run them against the namespace, then either offer to autoupdate everything, or point to a URL of the software maker to do that.
Password support - I can't tell you how many times I've been requested to have password-protected PDFs. As far as I know, Foxit doesn't support password-protected PDFs yet.
actually, I was putting JavaScript in Reader 4.05.
Not always. Look at, say, any good postscript viewer. Like ghostview or Okular, or any good printer. You can't read a .PS file without running it.
Not a sentence!
So, it seems that I'm not alone in finding it incredibly frustrating and back-to-front that Adobe don't offer the latest versions of any of their software for download, especially Acrobat and Reader.
You need to download the main installer, which will generally be X.0.0 of the software, and then there are a whole heap of updates.
Downloading these extra updates, when Adobe could simply update the version of the main installer, is a vast waste of bandwidth and a monumental waste of time.
I hope this prompts Adobe to ensure that the main installer for the software that you download from their site gets revised to be the current version of the software, rather than relying on having to be installed, and then patched, and then patched and then... This goes for all their software, not just Acrobat!
Specialist Mac support for creative pros, Melbourne
The irony being that PDF is a Turing- in complete variation of the (Turiong-complete) PostScript language. So what does Adobe do?
"Hey guys, lets embed a *completely different* Turing-complete language in our document specification!"
There's no place I could be, since I've found Serenity...
I hate adobe with a passion. There's so many halfwits who call themselves "developers" who rely on this crap.
What I'm boggling at is how come Adobe Reader files can include Flash content.
How are they planning on printing that?
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC