Slashdot Mirror
Adobe Warns of Flash, PDF Zero-Day Attacks
InfosecWarrior writes "Adobe issued an alert late Friday night to warn about zero-day attacks against an unpatched vulnerability in its Reader and Flash Player software products. The vulnerability, described as critical, affects Adobe Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux, and Solaris operating systems. It also affects the authplay.dll component that ships with Adobe Reader and Acrobat 9.x for Windows, Macintosh, and Unix operating systems."
... my iPad isn't affected !
Figure it out, Steve. Every other platform is getting Flash, I want the same opportunity for malware exploits that other mobile platforms will be getting.
I see the 64 bit Flash plugin for Linux has not been updated. Anyone heard of a timeline for this update?
Problems like this are common because reader and flash are ubiquitous, flash because it has no viable alternatives and reader because most users don't realise that there are far superior pdf viewers out there (i've even seen people install reader on macs where a far superior pdf viewer comes by default)...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
The closest platforms to getting it right are Apple and Linux distros. I say that because they provide a central software base and can push out updates all coming from one place. If you use something like Windows, you have to get updates from Microsoft, your hardware manufactures and then your 3rd party software. AFAIK, Windows still does not come with a PDF viewer, and I think its time for 3rd party plugins to completely disappear from web browsers. I've held the plugin belief for over 10 years.
Even if I say that Apple and Linux are better, they too are broken. And then there are 3rd party apps that continually want you to upgrade them before you run them. Its obnoxious. I can't think of any consumer or professional piece of equipment that needs such care and feeding. If my car has issues (yeah car analogy), then there is a recall. Its a big deal. I would never drive a car that says, "Before you start your car, there is an important safety update, do you want to install that update or blow it off?"
I guess I'm saying that now that internet access is available via cell technology and wifi and wired devices, and I don't know of anybody that uses a compuer not connected to one of these things, that bandwidth needs to increase and "cloud" or computing as a service needs to become a reality. Sure, nobody trusts these big bad internet companies with their data besides the exceptions like online tax services, online banking, facebook and their ilk, ISPs with their logs and their email, ecommerce, and other random services. But maybe, just maybe in the near future there can be a stable computing platform.
Deleting, renaming, or removing access to the authplay.dll file that ships with Adobe Reader and Acrobat 9.x mitigates the threat for those products, but users will experience a non-exploitable crash or error message when opening a PDF file that contains SWF content.
A initially rather secure document format (PDF) has become insecure because Adobe has added a plethora of mostly useless functions like Flash, Javascript etc to it.
Am I the only one sick of the "zero day" buzzword?
No, but I'm only annoyed when people misuse it. Zero-day has a specific meaning that is an important distinction when talking about vulnerabilities and exploits. When I hear "Zero-day", my immediate response is: "Oh ^&@#$, who put in strange trouble tickets the last few days?" and "Yay, Overtime for out of cycle Microsoft/Adobe patching."
No, problems like this are common because companies keep cramming more and more unnecessary crap into their software. From the article:
Why do you need "SWF content" in a PDF file? And then there was the story from a couple months ago about the ability to embed executable commands in a PDF file, and it it isn't a flaw - it's a feature built into the PDF spec. Sloppy programming combined with more and more crap that doesn't belong, guarantees that these problems will keep showing up.
var sig = function() { sig(); }
Buzzword or not, "zero day" means a vulnerability that is already being exploited by the time it's published. If vulnerability is published but no exploit exists -> no zero day.
Regardless of what you think of reasons for using that "zero day" label, this is very relevant to end-users: zero day -> you're at risk, NOW. No zero day -> you're probably safe (for the time being, that is).
Not entirely correct, historically it meant an exploit that was discovered by the vendor by the fact that it was being exploited. Meaning, they had zero days to develop a patch.
So if, for example, someone reported this to Adobe previously, and Adobe hadn't fixed it yet, then it isn't a zero day exploit. If Adobe only found out about the vulnerability because people were exploiting it, it was a zero day vulnerability.
Which might be what you were saying, but it didn't come out unambiguously that way. :)
If Adobe had the brains of a hamster, it would prohibit executable content in PDF files. Anything fancier than a fill-in-the-blank form has no place in a document format. Business needs some sort of standardized format in which to exchange written documents electronically, and PDF has fulfilled this role until now (barring the dimwits who still send Word files around). Allowing PDF to include executable content is not only dumb - it will eventually destroy PDF as a trusted format.
Enjoy life! This is not a dress rehearsal.
If the fix is critical, why is the Linux 64-bit version still at the vulnerable level?
No versions have been fixed yet so all versions are still vulnerable ... this includes Linux 64-bit.
Sent from my iPhone.
PDF has always seemed to me like a solution in search of a problem. There were plenty of better alternative formats available, both editable and non-editable. Then Adobe helped one of its former executives get elected to the Senate and the gov't suddenly decided that PDF was going to be official format of all government documents forever-and-ever-amen.
One of the first things that I do on my customers' servers (after asking permission, of course) is uninstall Acrobat. They're generally thankful that we're concerned about the security of their systems, and frequently unaware that Acrobat was even on the thing to start with.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
Show us the code Adobe. We of the nerd community would have had that problem fixed for you long ago.
Bibo Ergo Sum.
Not sure if it's related to the announcement, but today when I opened a whole bunch of Yahoo Finance pages at a go, I got an "open/download p.pdf" prompt. By reflex I cancelled that (and I don't use Adobe for PDF stuff anyway), but it may mean that someone has managed to use popular servers to infect machines.
Perhaps I should have downloaded and tried analyzing it. Not sure where it actually comes from- yahoo may use 3rd party servers for caching, and nowadays stuff like facebook also gets involved etc.
I don't doubt there's sloppy programming involved, but this sounds like a flaw in the spec... who the hell reviews the PDF spec and how much does Adobe pay them to approve of things like allowing code execution when it's supposed to be a secure document spec that is a mandated standard in critical venues like government and legal filings.
Make sure everyone's vote counts: Verified Voting
I wonder about this. I'm sure it's a rather complex issue (that will be picked apart time again for years to come), but the one idea that leapt out at me was one you pointed out:
... HTML5 core part of browsers will likely be much better maintained & secured than [Flash], will help.
HTML5 may not be a silver bullet, but my intuition tells me we'll be much better off. But not having a clear idea of exactly why this is and spouting my intuition out, while perhaps a Slashdot tradition, is not very constructive, so I offer this intuition with this disclaimer.
Damn, clicked Submit instead of Preview. Meant to add this from the advisory:
"Note:
The Flash Player 10.1 Release Candidate available at http://labs.adobe.com/technologies/flashplayer10/ does not appear to be vulnerable.
Adobe Reader and Acrobat 8.x are confirmed not vulnerable."
Some days it's just not worth
chewing through my restraints.
And how exactly is this a comment? Slashdot posters waffle on about their indifference all the time.
I cannot imagine who on earth would want Flash content in PDFs. I imagine it is still some brainless marketing fuck at Adobe who thinks PDfs will trump Powerpoint for presentation and so they have to cram in just as much useless shit as can be crammed into a pptx/pps file.
What truly fucking bothers me is that the "fix" they offer is not a fix at all. Installing a release candidate Flash player across a company will not be easy in many cases and who the fuck is going to go searching for craptasticadobeshit.dll on all their machines. Sadly, this is such a problem that you have no choice, unless you want to block all Flash content and in many industries, such as media or design, that's simply impossible.
Adobe is so fucking lost it's not funny. Their Flash player is a buggy, unsecure piece of shit. Their Acrobat PDF Reader is even worse, slow to start up, full of utterly useless shit that easily 99% of people who need to view a pdf don't need, and regularly an opportunity for malware authors to get at your machine. On top of this, Adobe is so choking on their shit that they coded almost all the dialogs in the new CS5 suite in fucking Flash, leaving previously satisified customers seething with anger because dialogs that were already pretty unstandard in the last two version of the CS ballsup are now more often than not, simply not working anymore.
For the love of God, please someone, anyone, make a decent alternative to the CS suite so we don't have to put up with Adobe's increasingly bizarre attempt to remain relevant by shovelling ever more shit into what were previously perfectly good apps!
Thanks Adobe, you help keep the Internet a fun and exciting place for everyone!
There were plenty of better alternative formats available, both editable and non-editable.
Such as?
The point of PDF wasn't about editable or not editable, which is probably why you think it was a solution in search of a problem.
The PDF format started out as a way to ensure complete display fidelity across display media and platforms. Unlike a word processor file, you did not have to worry about rendering differences, formatting inconsistencies, whether the destination system had the proper fonts or supported a given typographical control. These were the days before you could embed fonts in your .doc file and before hardware was powerful enough to piece together a Photoshop or Illustrator file on the fly.
It was a lightweight format for documents consisting of type and media files. Then Adobe started cramming everything under the sun into it, piling on code year after year in its ever-bloated Acrobat (a development model shared with almost all Adobe software). The fact that it was a finished display format meant that end-user editing was generally not possible with the viewer software. That wasn't the point of the design, it was just a consequence of the focus on display rather than creation--one that some people liked and one that others despised. Hence editable forms and the whole array of "interactive PDF" tools that got crammed into Acrobat.
PDF itself is still pretty lightweight and powerful, and it's extremely useful for compositing (OS X uses a very similar framework in its desktop compositor, hence the seamless PDF integration with Macs--and PDF rendering speed blowing the doors off anything Adobe has shipped in 15 years).
PDF is an ideal document format for ensuring everyone gets the same file in that you can make it once and show it everywhere. LaTeX is a tool for professionals, geeks, and typesetters. PDF is the only successful format for everyone.