Slashdot Mirror
Adobe Warns of Reader, Acrobat Attack
itwbennett writes "Monday afternoon, Adobe 'received reports of a vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions being exploited in the wild,' the company said in a post to the company's Product Security Incident Response Team blog. According to malware tracking group Shadowserver, the vulnerability is due to a bug in the way Reader processes JavaScript code. Several 'tests have confirmed this is a 0-day vulnerability affecting several versions of Adobe Acrobat [Reader] to include the most recent versions of 8.x and 9.x. We have not tested on 7.x, but it may also be vulnerable,' Shadowserver said in a post on its Web site. The group recommends that concerned users disable JavaScript within Adobe's software as a work-around for this problem. (This can be done by un-checking the 'Enable Acrobat JavaScript' in the Edit -> Preferences -> JavaScript window). 'This is legit and is very bad,' Shadowserver added."
I thought after so many vulnerabilities everyone had turned that off in Reader...
If you have to use Reader, ALWAYS disable Javascript. It always seems like that's was these exploits use. Or use one of the many PDF reader alternatives.
Normally that would be my first response as a joke, but I begin to wonder if Adobe could affect anything that is not root-level (or admin level).
The Kai's Semi-Updated Website Thingy
Yikes! I hate acrobat attacks!
It's NOT me! It's the meds! I'm on 1000mg of Fukitol.
Wherever it says 'Uninstall'
It is high time people stop using any pdf reader that uses javascript or opens external links or does anything other than simply render the document on screen. Editable pdf, where one can fill in the fields etc must be a separate application, not plugged into the browser. I feel safe with NoScript controlling FireFox. Hope someone comes up with a good general purpose sandboxer that will sandbox every plug-in.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Seems like deja vu, since this has issue cropped up before, what with everything from Adobe wanting to install (at least on Mac and Windows) with system level privileges and enable javascript by default. [Tell me again, how is javascript a desirable feature for this file type?]
Which makes it a good idea to use alternatives like Preview, and Skim (for OS X), as well as Foxit Reader for Windows.
It's not like there's a paucity of options to get away from Adobe's bloatware, no matter what OS you're running.
Some days it's just not worth
chewing through my restraints.
Separate your programs from your data, and your documents from your interactive media.
I want to delete my account but Slashdot doesn't allow it.
To send an email after filling out a form and clicking sumbit in a PDF.
Honestly - It's not really like the Adobe reader has the vulnerability, its just javascript in general. I mean it's not great that the reader will execute the code just by opening the file - but now that you know it does that, is it really the readers fault? Isn't the user executing the code as if he were clicking a button now?
I was browsing a soft porn site and suddenlty Acrobat launched, then crashed. So it looks like someone really is trying to use this. Since I use Acrobat 4, I think I'm safe from this. (I need a full version of Acrobat for DTP, and version 4 does the job, and quite quickly. If I need to open a later version file I use FoxIt.)
Acrobat and Reader are bloated. Try something a little lighter like XPDF or Okular.
Palm trees and 8
I would love a good alternative personally. All my users do is read the PDFs and we use PDFCreator for merging documents. I just havent found one that seems to be solid enough for the enterprise push. Any recommendations from people who have made the switch? I am getting tired of patching every 5 minutes.
CS: It is all sink or swim...oh and did I mention there are sharks in that water?
Half of my readings in Law School are scanned documents/books in PDF format. Many of the documents are 25-40 MB in size and several hundred pages. I find that PDFs actually load very quickly - much faster than a similarly sized Word or Open Office document, and easier to read. Of course, you can use any PDF reader and not just Adobe Reader/Acrobat.
On my Core 2 Duo and Core i7 systems, I can open PDFs pretty much instantaneously (less than 0.5 seconds). The only delay is the download. Thankfully, this is one area where Comcast's 25 Mbit "Speedboost" actually comes in handy. At school, being able to download at 100 Mbit/sec makes the files load even faster. The only issue is that Adobe Reader sometimes stalls and I have to try again. However, I find the Adobe reader plugin to generally work better than the alternatives, and I like the full screen reader. I've used Foxit for the tab support but I prefer Reader for its menu layout simplicity when I don't need many documents open.
or Here
Both are good places to start. You can end at the other.
Although, Foxit has added the Ass - err, Ask toolbar, which sucks. Fortunately you can not agree to the toolbar's terms, and it won't install (but Foxit will still install)
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
If you've ever worked with such off-shore developers, you'll immediately understand why Reader is such a shitty piece of software.
Yes because it's ok to buy something and not to bother making sure you're getting your money's worth.
Responsibility lies with management for not implementing some sort of quality control - ESPECIALLY when dealing with offshore outfits. It's called due diligence. But since a lot of managers only care about their paycheck and not the brand's reputation, etc., well, this crap happens. If the board are too busy figuring out how much to pay themselves on top of that, well, that's the corporate world in a nutshell.
Seven puppies were harmed during the making of this post.
You could try the Edit -> Preferences -> JavaScript window. Here, I’ll make a little instruction sheet for you.
http://img38.imagefra.me/img/img38/1/12/15/clone53421/f_viwjj0m_1729695.jpg
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Not that I don't trust myself, but this is really not the time to solicit javascript-enabled pdfs from strangers.
This space intentionally left blank.
No, he’s advocating disabling MIME types of particularly egregious known repeat offenders.
Opening PDFs in the browser is just an extra convenience anyway. When I click a link to a PDF, it automatically downloads to the desktop and I can open it from there, if I actually wanted to download and open the PDF. I don’t need it to load inside my browser (and if I didn’t expect it, I probably won’t appreciate having to wait for the plugin to load).
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Oh, thanks. That's nice and all but my company blocks all JPG images. Could I get that in a PDF?
> A spreadsheet app is also substantially larger than a PDF reader.
This *is* Adobe we're talking about here. For grins, I just installed Adobe Reader 9.2 and Gnumeric 1.9.16 on a XP VM, and for the informal survey of the "Program Files" directory, Adobe (203MB) weighs in at almost twice that of Gnumeric (106MB).
I vote for using the best app for the job. In the case of this thread, I wholeheartedly think the spreadsheet is that tool.
Method of processing duck feet
No, PDF format is a crippled postscript. It was intentionally crippled so it will NOT be a language, because distributing documents written in a programming language was not secure. Then they realized they crippled it too much, and added javascript to it. It is an improvement, since the scripts are localized in the document, easier to identify, they can be disabled if you want to, etc.
I think in general having scripting language embedded into an interactive document format is a good idea, however, it seems that Adobe's implementation is rather buggy and badly designed.
AccountKiller