New Adobe PDF Zero-Day Under Attack

← Back to Stories (view on slashdot.org)

New Adobe PDF Zero-Day Under Attack

Posted by CmdrTaco on Thursday September 9, 2010 @04:07AM from the duck-and-cover dept.

Rahmmp writes "Adobe has sounded an alarm for a new zero-day flaw in its PDF Reader/Acrobat software, warning that hackers are actively exploiting the vulnerability in-the-wild. An Adobe spokeswoman described the attacks as 'limited' but warned that that could change with the availability of public samples and exploit code."

36 of 203 comments (clear)

No credibility to this story by symbolset · 2010-09-09 04:08 · Score: 5, Funny

Whenever we have a credible PDF exploit story, the slashdot fine summary always links to a reliable PDF document that explains the exploit in detail. Sorry, not buying this one.

--
Help stamp out iliturcy.
1. Re:No credibility to this story by tlhIngan · 2010-09-09 04:13 · Score: 2, Informative
  
  Whenever we have a credible PDF exploit story, the slashdot fine summary always links to a reliable PDF document that explains the exploit in detail. Sorry, not buying this one.
  Funny, the only PDF I can find is a link from the FA which demonstrates the attack. The article itself is a regular web page, and I can't seem to find a PDF of the full disclosure.
What is this stupidity??? by gweihir · 2010-09-09 04:11 · Score: 5, Insightful

PDF is not a highly complicated format. It should be easy to interpret it safely. I strongly suspect that Adobe has invested exactly nothing into Acrobat Reader security over the years. Stupid. Incredibly stupid. Anybody that can should move to the alternatives right now.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
1. Re:What is this stupidity??? by Darkness404 · 2010-09-09 04:19 · Score: 4, Insightful
  
  Because Adobe has decided to take what should be a basic document format and added scripting to it.
  
  --
  Taxation is legalized theft, no more, no less.
2. Re:What is this stupidity??? by martas · 2010-09-09 04:21 · Score: 2
  
  what alternatives? no, seriously?
  
  --
  weinersmith
3. Re:What is this stupidity??? by MozeeToby · 2010-09-09 04:29 · Score: 4, Informative
  
  Foxit Reader is a nice alternative. It opens quickly, doesn't feel the need to update every other day or keep an updater service running all the time, and it doesn't have as nearly as many security issues. Alternatively, you could just do a search for pdf reader -adobe and come up with a variety of alternatives yourself.
4. Re:What is this stupidity??? by 6031769 · 2010-09-09 04:37 · Score: 2, Informative
  
  xpdf.
  
  --
  Burns: We're building a casino!
  McAllister: Arrr. Give me 5 minutes.
5. Re:What is this stupidity??? by Pascal+Sartoretti · 2010-09-09 04:41 · Score: 5, Informative
  
  what alternatives? no, seriously?
  The alternative is a format called PDF/A (see http://en.wikipedia.org/wiki/PDF/A), which happens to be exactly what you are looking for : a subset of PDF excluding (among others) scripting, video or audio.
  
  Now, all we need is a PDF reader with an option "only open PDF/A documents"
6. Re:What is this stupidity??? by SQL+Error · 2010-09-09 04:48 · Score: 4, Interesting
  
  They took a document programming language and stripped out all the programming features to make a document description format.
  And then they added a programming language.
7. Re:What is this stupidity??? by drolli · 2010-09-09 05:04 · Score: 4, Interesting
  
  Let me add: They started from a programming language where security is *easy to implement*.
8. Re:What is this stupidity??? by sqlrob · 2010-09-09 05:06 · Score: 4, Insightful
  
  I've never heard a 700 page specification called "not highly complicated"
9. Re:What is this stupidity??? by Lennie · 2010-09-09 05:23 · Score: 2, Interesting
  
  Funny you should mention that one, the last non-scripting exploit for Adobe Acrobat Reader was also an exploit for Foxit Reader.
  
  --
  New things are always on the horizon
10. Re:What is this stupidity??? by MozeeToby · 2010-09-09 05:29 · Score: 5, Informative
  
  Yep, and Firefox and Chrome have had exploits too. So have Linux, the iOS, and Mac OS 10. So has nearly every piece of popular, complex software. The rate of exploits found that affect Foxit is trivial compared to the number found in Adobe Reader.
11. Re:What is this stupidity??? by nashv · 2010-09-09 06:09 · Score: 2, Informative
  
  How about XPS ? *ducks* But seriously, the major problem is to convert the tons of literature , especially academic/scientific that exists as PDF into something else...
  
  --
  Entia non sunt multiplicanda praeter necessitatem.
12. Re:What is this stupidity??? by hairyfeet · 2010-09-09 07:03 · Score: 2, Informative
  
  Foxit actively sandboxes and refuses to run ALL code embedded in a PDF unless you actively turn off safe reading, and they have been doing this for quite awhile now, since that last bug you mentioned.
  And for anybody dealing with clueless users that want a butt simple way to install Foxit or several other free PDF readers like Sumatra, or need a butt simple way to install most of the basics like chrome, Firefox, or Flash, I'd suggest Ninite which has fully automated installers for over 90 programs. simply tell them which boxes to check and then run the installer. That's it. No toolbars, no "clickly clicky next next next", it just installs the software and leaves a shortcut on the desktop. Sweet and simple.
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
Fortunately... by mcgrew · 2010-09-09 04:12 · Score: 4, Insightful

"Unfortunately, there are no mitigations we can offer. "
I can offer one -- uninstall the Adobe reader until they patch the vuln. Meanwhile, how do I know if I'm alreadt pwned?

--
Free Martian Whores!
1. Re:Fortunately... by codewarren · 2010-09-09 04:24 · Score: 2, Funny
  
  If the exploit affects spelling, you have cause for concern
2. Re:Fortunately... by wbhauck · 2010-09-09 05:14 · Score: 3, Funny
  
  Meanwhile, how do I know if I'm alreadt pwned?
  It's all explained in this FREE guide. Just download our convenient PDF for more information.
3. Re:Fortunately... by ThatsNotPudding · 2010-09-09 05:51 · Score: 4, Funny
  
  Meanwhile, how do I know if I'm alreadt pwned?
  You start slurring your y's.
Disable Javascript in PDF reader by Anonymous Coward · 2010-09-09 04:26 · Score: 3, Informative

A work around for end users is to disable javascript, such as this guide:
http://praetorianprefect.com/archives/2009/12/disabling-javascript-on-adobe-acrobat/
For the enterprise you can disable it through group policy (which at this point seems like a good plan long term):
http://praetorianprefect.com/archives/2010/01/disable-acrobat-reader-pdf-in-the-enterprise/
Limited? by supernothing · 2010-09-09 04:30 · Score: 2, Informative

I guarantee that its exploitation isn't limited anymore: an initial exploit module was added to Metasploit last night.
Metasploit module

--
"All we have is logic and love on our side."
1. Re:Limited? by phantomfive · 2010-09-09 05:40 · Score: 2, Informative
  
  It's not a zero day, either. Check out what Wikipedia says (in case anyone is unclear what a zero-day is, since the submitter for one hasn't figured it out):
  
  A zero-day (or zero-hour or day zero) attack or threat is a computer threat that tries to exploit computer application vulnerabilities that are unknown to others or undisclosed to the software developer. Zero-day exploits (actual code that can use a security hole to carry out an attack) are used or shared by attackers before the software developer knows about the vulnerability.
  I guarantee that in the case the software developer knows about this vulnerability, since Adobe themselves made the announcement.
  
  --
  Qxe4
I work for Adobe and... by Anonymous Coward · 2010-09-09 04:37 · Score: 4, Funny

We invest a TON of $$ and hours into security. In fact, our security team pulls themselves inside out to fix things in a timely manner. Adobe takes security VERY seriously as we have governments all over the world trusting secrets to us. Nevertheless, as hackers focus shifts away from O/S exploits towards application level, there will likely be further attempts to compromise PDF readers. We will be vigilant and we will rise to meet future threats as they happen.
COS based PDF is also incredibly complicated if you adopt the entire ISO 32000 specification and expose the scripting and coding API's developers want. When you can write code to pinpoint the quads and move a point of one UTF 16 character within a book, that is powerful. Enough said on that.
Oh - and we are not lazy as some have suggested. My team pulled a 32 hour session last week.
- the adobe1
1. Re:I work for Adobe and... by Nursie · 2010-09-09 05:10 · Score: 2, Insightful
  
  Advice to you if you genuinely work for adobe - make a noscript option. Or even better - just cut out all the scripted elements.
  PDFs were and are awesome for one thing only, displaying documents the same everywhere. Active content is a mistake.
2. Re:I work for Adobe and... by sjames · 2010-09-09 05:33 · Score: 2, Insightful
  
  What's interesting is that PS is a full Forth like language in a VM and we never see crap like this attacking Postscript engines.
3. Re:I work for Adobe and... by MarcoAtWork · 2010-09-09 06:26 · Score: 3, Insightful
  
  My team pulled a 32 hour session last week.
  I am not sure how you can be proud of working 32 hours in a row on difficult security issues, nothing against your team but I wouldn't want any (and security-sensitive especially) code written at the 31th hour of a caffeine-fueled marathon by an exhausted developer... I do understand that 'we worked 32 hours in a row, we need to go home' sounds good to managers, but every single metric shows pretty clearly that working normal (as in, 8 a day) hours leads to much higher quality code.
  
  --
  -- the cake is a lie
4. Re:I work for Adobe and... by Svartalf · 2010-09-09 07:23 · Score: 2, Insightful
  
  Oh - and we are not lazy as some have suggested. My team pulled a 32 hour session last week.
  32 hour session? Uh, dude... I'm less than impressed. That's not hard work, that's sadomasochism in the workplace, brought on by badly missed deadlines for some un-stated reason. And it tells us quite a bit about WHY the quality isn't as much there as we've expected out of the past Adobe products and releases- and shows a glimpse of why we're not seeing 64-bit anything out of your claimed employer.
  Going that long without breaks and sleep leads me to believe you're actually the CAUSE of some of this stuff we're talking to. You WILL make mistakes past that 12 hour wall- it's human nature, pure and simple. Will you catch them? Maybe, maybe not- test isn't there as a safety net for this kind of crap and if they're working as hard as the devs, they'll miss stuff too. I won't really work much past 10 hours for myself as I'm going to start making dumb mistakes in that last two hours before the hard limit for people. If it were me, even as an anon coward, I'd not be bragging about going nearly 3 times past the hard limit for humans for the tasks we're talking about here.
  
  --
  I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Re:Can there be a 0-day that's not under attack? by tater86 · 2010-09-09 04:53 · Score: 2, Funny

I'm pretty sure we have this argument every time someone mentions zero day. If we could have a zero day bricking, we could have the best thread ever.
Re:PDF by ledow · 2010-09-09 05:03 · Score: 5, Insightful

1) Include a programming language that's not directly related to the task at hand and/or allows execution of dangerous statements. (Javascript in Adobe, VBA in Office, etc.)
2) Execute said code whenever and wherever you see it (VBScript / Javascript viewed in IE, ability to execute CScript, Adobe running Javascript and Flash content found inside PDF)
3) Use native code execution as part of your file format (WMF vulnerability - not relevant to PDF as far as I know but I couldn't be certain myself).
4) Bundle your program so that it integrates into everything (web browser, printer list, startup list, etc.) so there are as many avenues of accidental execution as possible open to an attacker targeting a large user-base program.
5) Introduce more and more levels of crap into the format, way beyond its original design (Font embedding, Javascript execution, form submission, JPEG, PNG, SVG, Flash, etc. direct embedding rather than converting to your supposedly "portable" document format etc.)
Pretty much, if you see a program do any of the above, it's likely to fall on its arse at some point, security-wise.
Evince, Okular, xpdf? by bill_mcgonigle · 2010-09-09 05:06 · Score: 2, Interesting

So, are any of the viewers I use vulnerable?

--
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
!Hackers by jgrahn · 2010-09-09 05:12 · Score: 3, Insightful
... warning that hackers are actively exploiting the vulnerability in-the-wild ...
Dudes, this is Slashdot. Can't you just for once use a term which *doesn't* have a positive second meaning to a majority of your readers? Try one of these:
- ... warning that criminals are actively exploiting the vulnerability in-the-wild ...
- ... warning that crackers are actively exploiting the vulnerability in-the-wild ...
- ... warning that malware authors are actively exploiting the vulnerability in-the-wild ...
- ... warning that Men of Low Moral Fiber are actively exploiting the vulnerability in-the-wild ...
Insult to injury, the updater SUCKS by scorp1us · 2010-09-09 05:18 · Score: 2, Insightful

There is way too much manual intervention required in the Adobe updater.
1. It does not download updates automatically.
2. It requires a new EULA to be accepted.
3. It makes you wait as it downloads the update
4. It makes you wait as it installs.
Ideally, the reader should download the update, install it in a shadow directory an as soon as that is ready, install the update.
If Reader is running, wait for it, or display a message to the user that they need to shut down the offending software before it will update. Give the user an option to close the software from the message box.
This way, in no more than 1 click you'll updated.

--
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
Re:A ton of money is... by Lennie · 2010-09-09 05:25 · Score: 3, Funny

Only on slashdot ?

--
New things are always on the horizon
Re:Rocket Scientists... by GigsVT · 2010-09-09 06:05 · Score: 2, Funny

The link seems to be broken.

--
I've had enough abrasive sigs. Kittens are cute and fuzzy.
Re:Switching between masters is not freedom. by Svartalf · 2010-09-09 07:04 · Score: 2, Informative

And it should be observed that Evince is also available for Windows and is under the GPLv2.
Sumatra's minimalistic and lacks some functionality, if you want the honest appraisal- the dev site openly admits not everything renders correctly. Evince seems to be pretty solid when it comes to rendering content correctly. I've yet to find a document that didn't view and print as the author of the document had intended.

--
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Re:Can there be a 0-day that's not under attack? by danaris · 2010-09-09 09:07 · Score: 2, Informative

means the code is known and no patch exists..
doesn't matter if you're the only one who knows the code, its still a zero day vuln until its patched.
No, it's just a known vulnerability with no patch. Zero day means it was exploited on day zero—that is, before anyone else knew the vulnerability existed.
Dan Aris

--
Fun. Free. Online. RPG. BattleMaster.