Slashdot Mirror
Adobe Warns of Reader, Acrobat Attack
itwbennett writes "Monday afternoon, Adobe 'received reports of a vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions being exploited in the wild,' the company said in a post to the company's Product Security Incident Response Team blog. According to malware tracking group Shadowserver, the vulnerability is due to a bug in the way Reader processes JavaScript code. Several 'tests have confirmed this is a 0-day vulnerability affecting several versions of Adobe Acrobat [Reader] to include the most recent versions of 8.x and 9.x. We have not tested on 7.x, but it may also be vulnerable,' Shadowserver said in a post on its Web site. The group recommends that concerned users disable JavaScript within Adobe's software as a work-around for this problem. (This can be done by un-checking the 'Enable Acrobat JavaScript' in the Edit -> Preferences -> JavaScript window). 'This is legit and is very bad,' Shadowserver added."
Why on earth do you need JavaScript in a PDF?
Separate your programs from your data, and your documents from your interactive media.
I want to delete my account but Slashdot doesn't allow it.
or Here
Both are good places to start. You can end at the other.
Although, Foxit has added the Ass - err, Ask toolbar, which sucks. Fortunately you can not agree to the toolbar's terms, and it won't install (but Foxit will still install)
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
If you've ever worked with such off-shore developers, you'll immediately understand why Reader is such a shitty piece of software.
Yes because it's ok to buy something and not to bother making sure you're getting your money's worth.
Responsibility lies with management for not implementing some sort of quality control - ESPECIALLY when dealing with offshore outfits. It's called due diligence. But since a lot of managers only care about their paycheck and not the brand's reputation, etc., well, this crap happens. If the board are too busy figuring out how much to pay themselves on top of that, well, that's the corporate world in a nutshell.
Seven puppies were harmed during the making of this post.
What bothers me about this is that once its disabled it just prompts you to enable it once it senses a JS PDF. The end user, if he or she has rights (and they do at home), just clicks another OK box instead of being forced to go into preferences and turn it back on. Once thats clicked it runs the JS and the exploit. Its ridiculous its even on by default, let alone this UI stupidity.
The next version of Acrobat should just have it off by default. Force people to turn it on. Chances are 99.9% of users have no legitimate reason for a JS PDF.
And then someone who is paying you money sends you a pdf and expects you to make comments using Adobe's proprietary comment system.
Nerd rage is the funniest rage.
We tested turning it off. It broke some important applications that use Reader as part of a workflow. There isn't any money in the foreseeable future to replace / rewrite these applications so Javascript is still on in Reader. This type of stuff is also what keeps us from going to alternate PDF readers. That plus the ability to digitally sign and several other things. Often (unfortunately) large companies find ways to use these things that make use of features that home users or smaller businesses find useless or bloat, etc. Heck, even our SOX compliance app uses this and it also breaks with Javascript off.
Somewhat ironic, isn't it? If you want to use Adobe's security features (digital signing/encryption) and 3rd party software to achieve SOX compliance - you must accept security vulnerabilities from Acrobat/Reader itself.