Google Employees Find 60 Security Holes In Adobe Reader

sl4shd0rk writes "Upon examining the PDF Engine behind Google Chrome, Google employees Mateusz Jurczyk and Gynvael Coldwind discovered numerous holes. This led them to also test Adobe Reader, which turned up around 60 holes which could crash the PDF reader, 40 of them being potential attack vectors. The duo notified Adobe, who promised fixes, but as of the latest updates (Tuesday of this week) for Windows and Macintosh, 16 of the reported flaws are still present (the Linux version has been ignored). To prove it, Mateusz and Gynvael obfuscated the info and released it, saying the unpatched holes could easily be found. The Google employees therefore recommend that users refrain from opening any PDF documents from external sources in Adobe Reader."

Comments

Very sad

[Anonymous Coward]

This makes me cry. :(

Re:Very sad

[Forty Two Tenfold]

Adobe is good ... at what the name suggests.

PDFs

[girlintraining]

PDFs have been a security headache for decades now. It originally started as an evolution of PostScript, but has since morphed into a "document solution". Adobe, like so many tech businesses, can't simply create a tool and then be finished. They always have to add more features, more code, more bloat. And surprise surprise, problems arise.

When I go to work on my car, I know my ratchets will work on any bolt on it; I just need to figure out what size it is and maybe an extender and I'm in business. My tools just work; they rarely break, and they don't stop working with next year's model... or the next decade's. Or the last. My ratchets will work on 1950s model cars, and I'm sure they'll still be useful on a 2050 model car.

Linux is more like my ratcheting set. Sed, awk, bash scripts... they don't change. They were there 5 years ago. They'll be there 5 years from now. They're simple, dependable, and "just work". What the fuck is so hard about making a read-only flat document that does the job of being easily readable and printable well? Stop adding features. Make the product do one thing well, and then use the profits to make a completely different product if you need something else done well.

Be like the ratchet.

Re:PDFs

[Eponymous Hero]

imho it got out of control when they added executable javascript.

Re:PDFs

[Meshach]

Stop adding features. Make the product do one thing well, and then use the profits to make a completely different product if you need something else done well.

Be like the ratchet.

That works for an open source project where the ultimate goal is to provide a usable product. If the project is already usable then do not add more features. Adobe though is a commercial product. They have to constantly change things and add new features so that their customers will need to upgrade to the latest version. This constant upgrading inevitably introduces instability.

Re:PDFs

[Forty Two Tenfold]

This constant upgrading inevitably introduces instability.

No wonder if you're trying to build a skyscraper from this.

Re:PDFs

[Anonymous Coward]

Adobe has a long long history of a "fuck you" approach to fixing bugs and making their products work nicely for customers. This disregard for everything except their insatiable greed is why there are sites like Dear Adobe and why many message forums are littered with posts from disappointed and disgruntled Adobe users.

At my work, we're stuck with Adobe Acrobat 9 as Adobe's site license upgrade pricing to Acrobat X is just so terribly expensive. Adobe doesn't make much of an effort to fix security issues with Acrobat 9 as they want to force their customers to upgrade to Acrobat X. We don't need or use any of the "features" Adobe has added to Acrobat for the last 4-5 years. Because Adobe has what is effectively a monopoly on PDF creation/viewing on Windows, we're stuck with their expensive insecure software. And upgrading every other version of Acrobat due to cost. There are alternatives to Adobe, but in an enterprise setting, they seem to create more problems than they solve.

Re:PDFs

[fm6]

Lots of products get "improvements" that are anything but. The point of making stuff is to sell it, and you can't sell new stuff unless you can convince folks that their old stuff is obsolete. You can see that any time you visit a car dealer.

Ratchet design isn't static because their makers woke up one day and said, "It's perfect! Let's stop trying to improve it!" They just don't have any design improvements that will convince you to throw out your old ratchets and buy new ones. If they could, they would.

Re:PDFs

[Jeremiah Cornelius]

Postscript - integral to PDF internals - is itself a Turing-complete language, derived from Forth.

It will always be a problem.

Re:PDFs

[Anonymous Coward]

Ratchets?? Sockets! You need more training, girl.

Re:PDFs

[EvilBudMan]

This reply is about your ratchets. Believe me the same thing is happening with mechanical stuff. Just look at the number of times Apple has changed fasteners on their iPhone so you can't open it without buying another tool. It's all part of the plan to keep you in the fold.

Re:PDFs

[cant_get_a_good_nick]

I'm in a devils' advocate mood today... I don't particularly like Adobe (nor do I hate them particularly), and I think reader is a bloated piece of crap.

But Reader changed not because Adobe has a PDF agenda to rule the world, but because Adobe economically needed it to change. To make money, gain market share, whatever.

A ratchet is a simple tool, one whose expectations won't change. But software (and cars) are much more fluid. Your ratchets may work on your 1950's car, but you won't like driving it. Engines are better now, tires are better, handling is better. You'll hate the boaty-ness of your 50's era driving, the gallons-per-mile you pay for driving it, the lack of safety features, the lack of DVD player dropping from the roofline for your kid in the back seat. I wonder simply how many safety regulations that would prohibit a "new" 50's tech car being sold. Adobe finds it difficult to get money out of a non-bloated Reader the same as any car company would go out of business if it sold nothing but 50's tech in cars.

What Adobe should have done is let some group without a profit motive - or a need to bloat it to hell - take over development. Such groups do exist - Apache being the best example. Adobe wants PDF to both be a universal utility, and a tool to bind you exclusively to Adobe. Those goals conflict.

Re:PDFs

[Anonymous Coward]

Seriously? I've been working on my vehicles for 38 years... I didn't have very many 'special service tools' back then but, while there are still a few bolts on vehicles, I would say the typical modern vehicle requires a lot more specialized tools to do basic things. I wouldn't be at all surprised to find that your ratchets aren't useful on your 2050 model vehicle. The head bolts on my 1993 toyota diesel can't be removed with a traditional 6 point hex socket, I need a 12 point socket.. You need a micrometer to determine whether you can re-use the head bolts or need to replace them. There are now hose clamps buried so deep inside the engine compartment you need a cable-actuated clamping tool to remove/install them.

Bringing us back to "Linux", used to be that Unix tools were primarily single-purpose until Linux came along and people started adding "-R" and "-r" options to commands like 'grep', or 'chown' or 'chmod'... Back in my day, we would use 'find'. 'ls' never used to have colors. So your Unix tools may never have changed, but mine did.

Re:PDFs

[Trepidity]

On cars, too, for that matter. Anything 1980s or earlier can generally be worked on with classic mechanics' tools, but 1990s and later stuff has an increasing amount of custom and electronic parts that need specialized tools.

Re:PDFs

[smooth wombat]

Adobe, like so many tech businesses, can't simply create a tool and then be finished. They always have to add more features, more code, more bloat. And surprise surprise, problems arise.

So you're saying they've adopted the Mozilla team's programming philosophy?

Re:PDFs

[Anonymous Coward]

Adobe Reader is freeware.
Why would Adobe want their "customers" (who pay nothing for the software) to constantly upgrade to new versions?

Re:PDFs

[RDW]

Linux is more like my ratcheting set. Sed, awk, bash scripts... they don't change. They were there 5 years ago. They'll be there 5 years from now. They're simple, dependable, and "just work"... Stop adding features. Make the product do one thing well, and then use the profits to make a completely different product if you need something else done well.

So you're not an emacs user then?

Re:PDFs

[cusco]

Most American cars now have covers over areas of the engine that need a custom tool, normally only available through the dealer, to get off. There are some models where you can't even get to the bloody spark plugs without a custom 7-sided Allen wrench. So far VW and Toyota seem to have avoided that particular bit of stupidity, don't know about the other non-US manufacturers.

Re:PDFs

[Anonymous Coward]

That's true, but PDF is a subset of Postscript rather than a generalized programming language. For example, the control structures are removed (if, loops, etc.) It should have been possible to put many more limitations on it. Instead, they added back even more ways to shoot yourself in the foot (e.g., Javascript). That's just nuts, and explains why Adobe Reader has been a bloated, ever-expanding program since... well, forever.

What they need is a "Lean PDF" that is strictly limited to describing the page content, with no internal programmability. It would make for simpler parsers that can be checked more easily for security flaws. The "kitchen sink" approach of the current PDF standard makes it fiendishly difficult to support without leaving opportunities for all sorts of mischief.

Re:PDFs

[JDG1980]

Adobe Reader is freeware. Why would Adobe want their "customers" (who pay nothing for the software) to constantly upgrade to new versions?

Adobe Reader is a marketing tool used to sell upgrades to Acrobat. They want to be able to ship new features in new versions of Acrobat, and to do this, they consider it helpful to be able to ensure buyers that "everyone" will be able to use their new whiz-bang documents/forms/whatever.

Re:PDFs

[Anonymous Coward]

Postscript is much less of a problem than javascript. The interpreter is simple and it only handles a "small" number of well defined graphics primitives. It doesn't interface with any other stuff but the document itself, not with just about anything on the internet via arbitrary URLs.

Aside from that, as far as I understand, PDF just handles a subset of postscipt to make it easier to implement.

Re:PDFs

[ColdWetDog]

Oh this has been going on for years. Even before the 1980's - SAAB, Volvo - I'm looking at you with your weird little engine tools. British stuff didn't need anything special (other than Whitworth wrenches) - a hammer and a screwdriver would disassemble pretty much any Triumph, Spitfire or Land Rover engine ever made. Of course, they couldn't hold a quart of oil for more than 48 hours, but you never had to actually change the oil, you just replaced it.

Re:PDFs

[ColdWetDog]

Seriously? I've been working on my vehicles for 38 years... I didn't have very many 'special service tools' back then but, while there are still a few bolts on vehicles, I would say the typical modern vehicle requires a lot more specialized tools to do basic things. I wouldn't be at all surprised to find that your ratchets aren't useful on your 2050 model vehicle. The head bolts on my 1993 toyota diesel can't be removed with a traditional 6 point hex socket, I need a 12 point socket.. You need a micrometer to determine whether you can re-use the head bolts or need to replace them. There are now hose clamps buried so deep inside the engine compartment you need a cable-actuated clamping tool to remove/install them.

Bringing us back to "Linux", used to be that Unix tools were primarily single-purpose until Linux came along and people started adding "-R" and "-r" options to commands like 'grep', or 'chown' or 'chmod'... Back in my day, we would use 'find'. 'ls' never used to have colors. So your Unix tools may never have changed, but mine did.

I wonder what the automobile equivalent of the Single Sided 360K floppy disk is ....

Re:PDFs

[onyxruby]

Be like the ratchet.

Point well made - something I wish more utilities would do. I would rather have a stable and secure PDF tool than a feature rich one constantly needs updated and patched.

Re:PDFs

[Burning1]

Ratchet design isn't static because their makers woke up one day and said, "It's perfect! Let's stop trying to improve it!" They just don't have any design improvements that will convince you to throw out your old ratchets and buy new ones. If they could, they would.

Not to be pedantic, but they have made many improvements to ratchets over the last 50 years.

- Ergonomic handle shapes
- Fine tooth ratcheting mechanisms (helps work in small spaces)
- Low profile designs
- Flex heads
- Different reversing mechanisms
- Different release mechanisms

Even now, you can go to hadware stores and see new and improved designs being marketed.

There are a couple keys with ratchet sets... The ratchet to socket interface is standardized; ball placement, shape, diameter, etc. This is much like API design in software. Because the interface between ratchet and socket is standardized, any attempts to introduce an incompatible ratchet will more or less fail, because no one wants to throw out perfectly good sockets. (To be fair there are a few specialty ratchets that are useful in situations where a deep socket isn't deep enough.)

Because the interfaces are all standardized, ratchet manufacturers have no way of creating compatibility issues that would force users happy with their existing ratchets to throw out all their ratchets and upgrade. Compare and contrast to Microsoft Office, where you pretty much have to upgrade with every new release, or you will be unable to open documents created by newer software.

Re:PDFs

[Alex Zepeda]

What, you mean metric spanners and sockets (and before that SAE)? Seriously Volvo put perhaps more thought in how things come apart than most other manufacturers. With 80s Volvos if you've got a bolt and a nut, they're typically different sizes (ex 17mm + 18mm instead of 2x 17mm). The bonus here is you can use one set of tools.

Whitworth... now that's weird (unless you're Australian).

Re:PDFs

[Alex Zepeda]

My ratchets will work on 1950s model cars, and I'm sure they'll still be useful on a 2050 model car.

Your ratchets, sure. Your sockets, not so much. Plenty of new types of fasteners have been introduced since the 1950s (TORX/E-TORX/TORX Plus, Pozidrive, metric hex stuff, etc).

Re:PDFs

[Anonymous Coward]

When they have perfected one product, they could create a new one, instead of pursuing diminishing returns and bloat.

Re:PDFs

[Alex Zepeda]

Mmm. Wrong. Modern ratchets (at least the higher end stuff) often have many more teeth than older ratchets. This allows them to be useful in more confined spaces. Both tools and expectations have indeed evolved. Someone who's used to the flexibility a new SnapOn Dual 80 ratchet afford probably wouldn't be super happy with an old 30 tooth model.

Re:PDFs

[Anonymous Coward]

Because by adding PDF features to Reader, they can also add those features to Acrobat Pro (the authoring/editing program) which is an expensive product they sell.

Re:PDFs

[JDG1980]

What they need is a "Lean PDF" that is strictly limited to describing the page content, with no internal programmability.

This subset already exists, and is known as PDF/A.

Re:PDFs

[icebraining]

You mean Mozilla, which started out with a huge monolithical suite and eventually separated them into individual applications? Mozilla, whose browser is using significantly less memory than an year ago[1]? No, not like Mozilla.

Re:PDFs

[Anonymous Coward]

Reader is just an incidental program Adobe uses to saturate the market with their industry-wide 'standard' PDF. In corporate circles the pricey Acrobat suite of creation/editing tools are a 'must have' even though the majority of PDF creation can be done with free utilities like PDFCreator or by just using the export function of applications like LibreOffice. Adobe makes big bucks selling Acrobat and if they let something like PDF just idle with no perceived added features it would lose it's dominance.

Re:PDFs

[Anonymous Coward]

Well I hope you wrote that post on a Z1 because, dammit, it just works. Who needs a keyboard and video display, they just add features and bloat.

Re:PDFs

[Em Adespoton]

...and sometimes, the only compelling reason to upgrade Acrobat is because bug/exploit fixes are only available in the current versions of their products.
On Adobe's side, they do add in improved data structures to the PDF standard as time goes on... using PDF-10 to create PDF/A documents of a reasonable size and clarity is much easier than using PDF-3....

Re:PDFs

[Anonymous Coward]

PDFs have been a security headache for decades now. It originally started as an evolution of PostScript, but has since morphed into a "document solution". Adobe, like so many tech businesses, can't simply create a tool and then be finished. They always have to add more features, more code, more bloat. And surprise surprise, problems arise.

Be like the ratchet.

Amen brother!

Re:PDFs

[Em Adespoton]

I'm in a devils' advocate mood today... I don't particularly like Adobe (nor do I hate them particularly), and I think reader is a bloated piece of crap.

But Reader changed not because Adobe has a PDF agenda to rule the world, but because Adobe economically needed it to change. To make money, gain market share, whatever.

A ratchet is a simple tool, one whose expectations won't change. But software (and cars) are much more fluid. Your ratchets may work on your 1950's car, but you won't like driving it. Engines are better now, tires are better, handling is better. You'll hate the boaty-ness of your 50's era driving, the gallons-per-mile you pay for driving it, the lack of safety features, the lack of DVD player dropping from the roofline for your kid in the back seat. I wonder simply how many safety regulations that would prohibit a "new" 50's tech car being sold. Adobe finds it difficult to get money out of a non-bloated Reader the same as any car company would go out of business if it sold nothing but 50's tech in cars.

What Adobe should have done is let some group without a profit motive - or a need to bloat it to hell - take over development. Such groups do exist - Apache being the best example. Adobe wants PDF to both be a universal utility, and a tool to bind you exclusively to Adobe. Those goals conflict.

May I introduce you to GhostScript? http://en.wikipedia.org/wiki/Ghostscript

Unless you want the bells and whistles that introduce security holes, Ghostscript is what you want as a PDF reader/writer. Reader *IS* the bloatware version. There's lots of other readers and writers out there that can handle the actual PDF standard; Reader just handles the bloat.

Re:PDFs

[Em Adespoton]

Linux is more like my ratcheting set. Sed, awk, bash scripts... they don't change. They were there 5 years ago. They'll be there 5 years from now. They're simple, dependable, and "just work"... Stop adding features. Make the product do one thing well, and then use the profits to make a completely different product if you need something else done well.

So you're not an emacs user then?

vi'e alway's thought of emacs as an OS....

Re:PDFs

[Em Adespoton]

Be like the ratchet.

Point well made - something I wish more utilities would do. I would rather have a stable and secure PDF tool than a feature rich one constantly needs updated and patched.

So use Ghostscript. Unless you're actually using the bloatware features, there's no reason to use Adobe Reader. OS X has Preview, Windows has Foxit Reader, and everyone has Ghostscript. None of them are as good at *creating* PDFs as Acrobat, but they're all better than Reader at reading them without destroying your security model and eating up resources.

Re:PDFs

[Anonymous Coward]

What they need is a "Lean PDF" that is strictly limited to describing the page content, with no internal programmability.

This subset already exists, and is known as PDF/A.

Great, now where is the corresponding Adobe Reader/A software?
I miss Acrobat Reader v1.0

Re:PDFs

[bcrowell]

Postscript - integral to PDF internals - is itself a Turing-complete language, derived from Forth.

It will always be a problem.

No, because PDF, unlike PS, was intentionally designed to be Turing-incomplete. That was a good design decision, which was then unfortunately screwed with when they added javascript.

Re:PDFs

[Cederic]

Exactly. Nobody needs Adobe Reader installed and everybody should avoid it.

Sadly at work I have Adobe Acrobat installed. Not my choice.

Re:PDFs

[dbIII]

Whitworth is the mechanically ideal thread, but it's at an angle that doesn't match up with anything you'll get if you divide a circle by 360 parts. That put it into the "too hard basket".

Re:PDFs

[Anonymous Coward]

Wow, I thought you were talking about web browsers, and could see your point but thought it was a bit strong. Then I read the other replies. What the actual fuck?

Re:PDFs

[Anonymous Coward]

So an open source product adds value in the market (usually for free) and a commercial product mostly adds the illusion of value and not all that much real value. So it's mostly a scam. And that goes for many, many products, software and otherwise.

It's not surprising. We don't need many of us to produce our food. We don't need many of us to produce our goods. We've automated an awful lot and we invented powerful machines to do the heavy lifting for us. But we need to earn a living, we need to be useful to society, and we created an illusion of usefulness to keep everyone busy. Are the people who keep adding features to software because it needs to be different than last year actually doing anything useful? And loads of people working in banking and insurance? I doubt it, many don't add any real value to our society, but they have a job and work hard, so the illusion of usefulness is maintained.

In reality we don't need to be that useful anymore, we've outsourced that to machines. The problem is that we instead of enjoying the freedom that should give us and be useful to each other by having a social life we keep behaving as if that hasn't happened, and seem to work harder and harder instead, with less and less time for a social life. No wonder we have financial crises and bursting bubbles, driven by a need to compete that really belongs to a world of scarcity. I know that communism failed miserably and something like that won't offer a solution, but the patterrn we're currently trapped in isn't healthy either.

Re:PDFs

[Anonymous Coward]

yeah, and it's *still* using way too much effing memory :)

Re:PDFs

[Anonymous Coward]

PDF does not require PostScript beyond a few basic operators used for certain types of shading patterns, and for parsing Type 1 fonts. It's certainly not integral - you can display many documents without it - and for what is required there are no operations that could have any security impact, ie file or network access.

Check the spec - PDF 32000-1:2008 annex B if you really want the details.

PDF has a long history of being fairly shambolic with some very poorly thought out extensions. Their Forms specification is a particular nightmare, and that was before their even more shambolic XFA Forms extension which is mercifully absent from the ISO specification. But if PDF itself were the issue it would be every PDF viewer that has problems and it's not - it's only Acrobat. The reason is the extra bells and whistles that aren't part of the core PDF specification: JavaScript and the PDF DOM, Flash, interaction with plugins, actions that launch external files and so on. The fairly broad PDF ecosystem beyond Acrobat has none of these issues.

Disclaimer: I am part of that ecosystem.

Re:PDFs

[EvilBudMan]

Wasn't about 3 Whitworth wrenches capable of removing an Engine from a Centurion tank? We'll that and a hammer.

Alternative readers?

[SQLGuru]

I'd like to see them include some of the alternative readers (Foxit, etc.) included in their testing since they are somewhat popular among people who have thought that Adobe Reader was bloated and slow for quite a while.

Re:Alternative readers?

[denis-The-menace]

I tried Foxit

My Quickbooks has Adobe PDF writer built-in (only good for QB use!)
Somehow, that has made Adobe Reader get called in FF instead of Foxit.

It reminds me of the file association wars between Quicktime, WinAmp and WMP.

Re:Alternative readers?

[Anonymous Coward]

And then there's the Apple reader too.

Re:Alternative readers?

[gmuslera]

In Ubuntu (and probably other distributions and gnome based desktops) the default viewer is Evince, in KDE ones is Okular, and you have embedded viewers in other apps, like in google chrome. There is no need to install Adobe's unless you need some special added feature. A list of software that works with PDF can be found in Wikipedia

Re:Alternative readers?

[SQLGuru]

I know about the alternatives.....but what I want to know is if any of them have the same security holes (or conversely, which PDF viewer is the most secure).

Re:Alternative readers?

[gmuslera]

Is implicit in the announcement that at the very least the Chrome embedded viewer should be safer. Anyway, probably the other viewers are based in the pdf specification not in acrobat reader code, so they shouldn't share some if not all those vulnerabilities (but could have different ones)

Re:Alternative readers?

[antdude]

What about handling forms and complex features?

Re:Alternative readers?

[nzac]

They don't have the same ones. The alternatives focus on an old PDF standard, that is what almost all PDF documents are and don't include all the executable stuff.
As far as i know the alternatives very rarely have issues, I can't remember ever seeing a security for evince.

Re:Alternative readers?

[Anonymous Coward]

I use Foxit v4.3.1. I'd use to a newer version if it wasn't for the GUI changes. It's sort of the same, but sort of not. And that sort of not pushed me over the edge that I just went back to v4 from v5.

Re:Alternative readers?

[Anonymous Coward]

I cannot prevent Adobe to be installed if I want to read some Google results. Adobe should have lost when WYSIWYG appear, when fonts came installed in the MS OS, but they subsisted by creating an uneeded document format. Doing anything in PDF is a pain. I ve never printed any PDF at all but have printed HTML. The company went into Flash, now is going back or something? There are plenty of new doc names around but they seem to be ubiquituous and indispensible. And I am constantly updating both Adobe and Flash because otherwise something will not work! Those are not consummer products but something else. I consider it non standard and a null for content searches. Maybe MSFT should buy it out and put it to rest, or they should turn into something like eBook, particularly now that books I would expect in PDF appear as searches in google books.

Re:Alternative readers?

[stoatwblr]

That's where things get difficult - and where sometimes we have to abandon a perfectly functional linux desktop for MS or Apple in order to get things done.

Re:Alternative readers?

[antdude]

Or just use Adobe Reader for Linux?

And in other news...

[kootsoop]

Google announces a new initiative: Google Document Format, for all your document sharing needs.

Re:And in other news...

[Anonymous Coward]

Well, they do already have their own formats that they use for Google Docs. They just don't tell you what they are. However the Google Docs tools (which I admittedly use a lot for sharing, etc.) are amazingly useful at deleting things from documents that they import. For example text boxes in Excel get dropped completely when you convert to Google Spreadsheet. No warnings. Just dropped. The same things happen to some Word document elements when you import to Google formats. However, if you have a very basic document or spreadsheet to share Google Docs works well for it.

Re:And in other news...

[Anonymous Coward]

Google doesn't need to create a new document format. As Google did with the Chrome browser, all they need to do is create a better client:

-- open source
-- free
-- secure
-- fast
-- lightweight
-- works nicely, i.e. updates without rebooting your computer, etc.
-- offers high fidelity "print to PDF" functionality

Do this and much of Adobe's low end Acrobat revenue disappears. And perhaps even more than with Chrome, Google becomes the hero of the enterprise. There is an awful lot of unhappiness out there for the crappy Acrobat software that Adobe forces on people.

Re:And in other news...

[Bert64]

There are already numerous better tools for viewing, creating and editing pdf files than acrobat... And yet many people still think pdf is a proprietary format that requires acrobat, and there are many websites carrying pdf files which even try to advertise this false information.

I have even seen mac and linux users, who generally have a far superior pdf viewer installed by default, using acrobat... Never understood why.

It's not better tools we need, its better awareness that these tools exist.

Also even if these viewers are just as insecure, simply having diversity will improve things massively.

Re:And in other news...

[steelfood]

Why create a new document format? There already are enough free, open, standard ones out there to fill every niche. There's ODF for WYSIWYG. There's LaTex for typesetting (PDF replacement). AJAX and HTML5 for interactive pages.

It's just a matter of enabling them in Chrome, and offering it in their search. For example, they could build LaTex and ODF viewers right into Chrome. They can then convert every PDF and Word Doc into LaTex and ODF to be displayed in this embedded viewer. Present a "Convert to LaTex" button for every PDF file their search result indexes and do the same for Word docs and ODF. Instead of "view as html", use "view as LaTex" and "view as ODF".

Anybody who wants to view PDF and Word Docs natively would then have to download and open the file up in the viewer manually.

Re:And in other news...

[jc42]

I have even seen mac and linux users, who generally have a far superior pdf viewer installed by default, using acrobat... Never understood why.

Well, I ran across a reason a few weeks ago. I have a Macbook Pro, and I'd been using the builtin Preview program to display PDFs, as well as the Safari browser which does the job in its own windows. Then, a few weeks ago, I downloaded a PDF file from IMSLP, and both Preview and Safari showed a lot of the pages as illegible smudges. I tried it in xpdf on my nearby Ubuntu box, and had the same problem there (though a few of the problematic pages did display legibly.

Just for fun, I decided to finally download Acrobat and see how it screwed up the file. It didn't screw up at all. Amazing! All the pages that Preview and Safari showed as smudges are quite readable. In fact, it's still sitting there, with a half-buried page 103 partly visible at the upper right of my screen.

Now, I do have to admit that Acrobat is a royal PITA. For example, about an hour after I first fired it up, whenever I clicked on its window, the menu bar at the top of the screen disappeared. It took an unbelievable amount of googling to find more than just questions about this, but after wasting the time over several weeks, I finally stumbled across a mention of the magic key combo (CMD-Shift-M) that turns the menu bar on and off. Maybe I'd accidentally fat-fingered that one time; maybe it came from some hidden default; I'll probably never know.

I won't go into all the other hassles, and I don't intend to use Acrobat much. But for this one file, whatever the problems are, Acrobat does at least make its contents readable. So I'll probably keep it around for when Preview and Safari screw up on some other file. I've seen a few other files that show one or two pages that are smudges, but I've found those pages elsewhere in a different format. This time, the smudged pages (or the whole file) doesn't seem to exist anywhere else, and Acrobat is the only thing I know that displays it in its entirety.

(Well, except for the pages where it just displays a message saying that the page is missing from the museum's hard copy. But I'm pretty sure that's not Adobe's fault. ;-)

Re:And in other news...

[Em Adespoton]

Exactly!

en.wikipedia.org/wiki/List_of_PDF_software

I mean, there's even a Wikipedia page on it. Adobe's just done an excellent marketing job, and gets their reader bundled with EVERYTHING.

Re:And in other news...

[Em Adespoton]

Present a "Convert to LaTex" button for every PDF file their search result indexes and do the same for Word docs and ODF. Instead of "view as html", use "view as LaTex" and "view as ODF".

Anybody who wants to view PDF and Word Docs natively would then have to download and open the file up in the viewer manually.

Converting PDF to LaTeX would be like convering Java bytecode to Java source... sure, it's possible, but editing it isn't going to be very pretty and the output's going to be really bloated....

Re:And in other news...

[imsabbel]

Thats funny, with the LaTeX... as the only way LaTeX actually looks nice is after you have converted it to PDF...

Lets get this started...

[nighthawk243]

>Adobe in charge of security.

Bad business

[Anonymous Coward]

Adobe essentially has the userbase by the balls here, and would much rather focus on making more money than paying some self-righteous developers for a few weeks to fix 'security flaws.'

I can imagine a management meeting at Adobe now:
"Those damn programmers put more flaws in Reader!"

Irresponsible disclosure

[Hatta]

Google was irresponsible in not publishing these holes immediately so affected users could take steps to mitigate their vulnerability while Adobe put together a patch.

Re:Irresponsible disclosure

[Anonymous Coward]

maybe they were busy exploiting these holes by sending their competitors PDFs?

Re:Irresponsible disclosure

[bill_mcgonigle]

maybe they were busy exploiting these holes by sending their competitors PDFs?

Nah, they just used them to bypass Safari tracking protections.

Re:Irresponsible disclosure

[silas_moeckel]

You really think nobody else knew about these already? per your sig censorship is obscene is this any different? Whats the downside the vulnerabilities are not there and thus not an issue or people can be informed and mitigate them? You can only guess that nobody else has discovered an issue it's better to assume somebody has and fix it than to sweep it under the rug.

Re:Irresponsible disclosure

[Anonymous Coward]

The big software companies (Apple, Microsoft, Adobe, etc.) have worked really hard to punish people who publish security vulnerabilities. Google did a good thing. Not the best thing they could do, but as much as they could do without having to deal with Adobe's legal department.

Re:Irresponsible disclosure

[Anonymous Coward]

Yup, there is literally NO thing Google won't do, no law they wont break, no privacy they will not violate, to get all the tracking details on that oh so important 1 or 2 percent of web users who use Safari! I personally know (knew!) about 10 people who were murdered because they got in the way of Google tracking ONE SAFARI user's browser! They are just that serious.

Fucking Slackers!

[Anonymous Coward]

Those fucking slackers could only find 60 holes in that Swiss cheese? And, they couldn't even bother looking at Flash!

Oops, I have to go. My PC needs to reboot after the third Flash and Reader update today.

Re:Fucking Slackers!

[Burning1]

Maybe they just gave up and stopped counting at 60?

Re:Fucking Slackers!

[Cyko_01]

actually they did some flash fuzzing already

Re:Fucking Slackers!

[Anonymous Coward]

Maybe they just gave up and stopped counting at 60?

Or maybe it was in hex?
0x60 is probably closer to the actual number of critical bugs that exist.

Re:Fucking Slackers!

[Anonymous Coward]

Google has made incredible strides towards making Flash safe. Recent versions of Chrome have Flash completely sandboxed, IIRC.

Google.

[Anonymous Coward]

I can't tell if the news is that there are security holes, or that these people are Google employees. Why does this article emphasize that point so much? Why is it so important that they are Google employees? And why do we all capitalize Google like we capitalize God?

Re:Google.

[Fwipp]

Because it's a proper noun.

How hard is it to find security holes in Adobe?

[Anonymous Coward]

I guess they just Googled it...

Best part of the article for me...

[sstamps]

The name of the researcher "Gynvael Coldwind".

Too cool, in more ways than one. :D

Thankful for Firefox 15 beta pdf.js

[Anonymous Coward]

I've never had the Adobe plugin and avoided plugins by Foxit and SumatraPDF in favour of just opening them in the standalone viewers.
Now I hope the same security audit of pdf.js in Firefox is done before it's released.

Re:Thankful for Firefox 15 beta pdf.js

[93 Escort Wagon]

PDF.js is so mind-numbingly slow when rendering large PDF files, it's just ridiculous. It's simply not a useful solution in a work environment.

Re:Thankful for Firefox 15 beta pdf.js

[ChunderDownunder]

Nevertheless, if you want to create a properly sandboxed viewer capable of executing embedded JS, it's possibly the right approach. i.e. using the available battle-hardened Javascript engine embedded in your web browser. With a major caveat that PDF is a format primarily for printing as opposed to rendering onscreen.

I would ask if translating PDF to HTML5 is inherently slow or just that the implementation hasn't yet received sufficient optimisation. e.g. gmail's own render farm generates HTML on the fly for PDF attachments.

Re:Thankful for Firefox 15 beta pdf.js

[Cederic]

if you want to create a properly sandboxed viewer capable of executing embedded JS

That would be the problem. Just don't support embedded JS.

Bad Adobe. Bad!

[Anonymous Coward]

Has Adobe ever released anything that wasn't total sh*t? Ever? Seriously.

Re:Bad Adobe. Bad!

[oldmac31310]

Not in recent years, in my experience.

Re:Bad Adobe. Bad!

[bn-7bc]

well IMHO Premiere pro is quite good Disclaimer: I'm new to video editing so I may be way off here

Re:Bad Adobe. Bad!

[Anonymous Coward]

Adobe After Effects.

Re:Bad Adobe. Bad!

[ColdWetDog]

The mugs they give out at the National Association of Photoshop Professionals meeting are pretty cool.

Re:Easy enough

[itsme1234]

30 EUR for a single license for "PDF-XChange Viewer" and you get only "1 year of product maintenance" (which probably means after one year you need to pay for security patches).
For a freaking pdf reader? And with no real assurance that this one isn't again full of security holes. Get real.

The Acrobat Plug-In Is Garbage

[damn_registrars]

I just removed it from my browser a while ago after I finally got sick of it crashing. I now use Okular to read PDFs and life is much better that way. I don't know why anyone would tolerate such a miserable plug-in.

Re:The Acrobat Plug-In Is Garbage

[Anonymous Coward]

I really like Okular. I even use it on Windows via the Windows KDE port.

*Very* Sloppy Summary

[fm6]

The summary muddles two distinct PDF readers, the PDF reader built into the current version of Chrome (purely Google) and the PDF reader from Adobe that's completely separate. The Google reader is relevant only because the vulnerabilities in the Adobe reader were discovered using the tools developed to find vulnerabilities in Chrome.

Re:*Very* Sloppy Summary

[Trepidity]

The PDF reader in Chrome doesn't seem to be purely Google. On this page comparing Chrome to the open-source Chromium distribution, they mention that they can't open-source the Chrome PDF reader because:

The Chrome PDF plugin uses 3rd-party non-free code; no Free Software PDF plugin exists that supports all the PDF features we'd like (such as filling in forms). :(

Whose third-party code? Adobe's? Someone else's?

Re:*Very* Sloppy Summary

[fm6]

Chromium seems to have diverged a bit from Chrome. The Google PDF reader I was describing is built into Chrome. It's not a plugin. I can't say for sure that it contains no 3rd party software, but I doubt it. It's pretty feature-limited.

Re:*Very* Sloppy Summary

[jhol13]

Besides, would they have used tenth the time in Linux, Windows, iMacos, or whatnot, they would have found at least twice the amount.

I am extremely disappointed on Linux "security" (i give a shit about W or i). I get several updates every day. This has gotten worse since -90, and is getting much worse extremely fast.

We FUCKING need ABI! We FUCKING need design (and I do not mean kernel alone).

Re:*Very* Sloppy Summary

[Justin_Schuh]

That's incorrect. There's never been a PDF reader built into Chromium. The Chrome PDF reader (added in Chrome 8) has always been licensed third-party code in a plugin that ships with Chrome. It's fully sandboxed using PPAPI and has been aggressively audited and fuzzed (this latest round of fuzzing just used a more advanced toolset, so it found new things).

Re:*Very* Sloppy Summary

[Anonymous Coward]

So you're one of the type 2 Linux users: the cheapskates. You're not ethically opposed to proprietary software--indeed your ABI comment suggests you seek to sell it--but you won't use an OS you have to pay for.

Re:*Very* Sloppy Summary

[Anonymous Coward]

I was under the impression Chrome's PDF reader was built on foxit.

http://googlesystem.blogspot.com/2010/08/google-chromes-pdf-plugin-uses-foxit.html

Re:*Very* Sloppy Summary

[fm6]

There's never been a PDF reader built into Chromium.

Reading skills, dude. I didn't say there was.

Re:*Very* Sloppy Summary

[Justin_Schuh]

Sorry, the antecedent in my response was a bit misleading. What I was correcting was the claim that the PDF reader wasn't a plugin. It's in fact a plugin that ships with the browser (like the Flash plugin does). Third party plugins have always been a difference between Chromium and Chrome, because there's no license to distribute the binaries outside of the official Chrome builds.

Re:Easy enough

[h4rr4r]

Why not just use a free one?

$30 for a pdf reader is pretty steep.

Re:Easy enough

[Anonymous Coward]

30 EUR for a single license for "PDF-XChange Viewer" and you get only "1 year of product maintenance" (which probably means after one year you need to pay for security patches).
For a freaking pdf reader? And with no real assurance that this one isn't again full of security holes. Get real.

The 30EUR product is their Pro version (more like Adobe Acrobat Standard), they also have a free version which does everything Adobe Reader does and more.

Re:Easy enough

[Anonymous Coward]

Don't use Adobe Acrobat Reader.

Unfortunately, some PDF documents can only be opened with Adobe Acrobat. See http://www.quickpdflibrary.com/faq/if-this-message-is-not-eventually-replaced-by-the-proper-contents-of-the-document.php

Re:Easy enough

[Anonymous Coward]

Ahem

The FREE PDF viewer download of the PDF-XChange Viewer may be used without limitation for Private, Commercial, Government and all uses, provided it is not -: incorporated or distributed for profit/commercial gain with other software or media distribution of any type - without first gaining permission.

It's got commenting features without watermarking and even does OCR which I have been very impressed by.

Common Factor?

[Anonymous Coward]

of vulnerability? Wouldn't that be Adobe? Two product of their's Flash and Reader and they don't fix them.
I smell capitulation with the enemy.

Re:Easy enough

[PNutts]

Third party clients also have exploits.

Is there a tool that does *all* reader functions?

[cant_get_a_good_nick]

I had Reader on my Mac because I had to cryptographically sign something. Is there something out there that does both forms and cryptographic signing?

Also, I forgot about Reader until something asked me to update it. I promptly deleted it, but where did the updater spawn from? Id love to remove all adobe code from my machine.

Informed disclosure?

[bill_mcgonigle]

Google was irresponsible in not publishing these holes immediately so affected users could take steps to mitigate their vulnerability while Adobe put together a patch.

The Full Disclosure folks say that vulnerabilities should be disclose immediately. Their arguments have some merits. The Responsible Disclosure folks say that the vendor should have n number of weeks to get a patch out, then it goes to Full Disclosure. That has some merits as well, but the trouble is the public doesn't know there's a problem during the n weeks. The calculation is a balance of how many people will be protected vs. how many people will be harmed.

It occurs to me that a third way, call it 'Informed Disclosure' for now, would be to:

1. Make an announcement that x number of vulnerabilities have been discovered in the foo function of bar
2. Wait the n number of weeks
3. move to Full Disclosure

as a way to avoid the problem with Responsible Disclosure but still give the vendor reasonable time to react. e.g. 'Informed Disclosure' may say:

ISSUE-001: Acrobat Reader has a vulnerability with JavaScript objects embedded in documents that can cause a smashed stack. Disable JavaScript in Acrobat Reader to avoid this problem.

and then send Adobe the exploit code, which will be published in 45 days. This also removes the illusion of potential blackmail from security researchers, because the public has on-record information that the disclosure will be published, regardless of the action or inaction by the vendor.

Surely others have taken this approach, but I can't find a name attached to it -- anybody?

Re:Informed disclosure?

[dutchwhizzman]

You can get a CVE nuber reserved for your vulnerability I believe? I guess you could give a description at that moment and publicly open the CVE later on?

Re:Informed disclosure?

[antifoidulus]

Um, the public doesn't know it's a vulnerability for n+x weeks where x is the # of weeks between the vulnerability was created and when it was discovered.. The detection of the vulnerability isn't actually responsible for the vulnerability.... Your proposed solution would be the worst of both worlds.... Letting everyone, including potential attackers, know that vulnerabilities exist without actually giving anyone any real way to protect themselves as the announcements don't contain any real information....

Re:Easy enough

[Anonymous Coward]

Got 5000 employees? 30*5000 is 150k every year. or 1.5 million dollars over 10 years. Or the salary of 3 employees. Brilliant!

Hopefully, Google checks the .pdf's

[Anonymous Coward]

that they provide links to against these attack vectors?

Re:Easy enough

[Joce640k]

Don't use Adobe Acrobat Reader.

Everybody in my small office uses PDF XChange Viewer.

Or just use Google Chrome. It reads PDF with no plugin. It still lacks a few features but I assume they're working on that in between fixing the holes for Adobe.

Adobe Management Failure!

[Anonymous Coward]

Adobe management should have attacked these issues for PDF and Flash like Microsoft did for many years. It takes time, but Microsoft actually has gotten much better.

Adobe management has not learned. They've basically ignored security in all their programs for years. Back in 2008, many started calling on us all to avoid Adobe for our own safety. They were right. I was late in calling for this boycot - it was 2010.

Nobody should be using Adobe products unless they make a living using them. For everyone else, there are alternatives - alternatives to flash, alternatives to PDF and alternatives to all those other Adobe video and image tools. Only the extreme hard-core users of Adobe should continue.

Adobe management has not shown that they understand the issues still. They don't care about security and if the last 4 yrs hasn't gotten them to change, they never will.

False!

[Anonymous Coward]

PDFs have been a security headache for decades now.

PDFs have been no problem. PDF readers that can execute scripts and code are the issue.

Re:Is there a tool that does *all* reader function

[93 Escort Wagon]

Fortunately, most Mac users don't need Reader at all. Preview handles PDF viewing very well and is amazingly fast.

I have Acrobat Pro installed out of necessity (for work), but all of its auto stuff is turned off - I really only need it once or twice a year. But still... I consider Acrobat a malignant tumor on my hard drive. I may have it walled off, but it's still there, patiently waiting for a chance to spread its poison...

Really, the world would be a better place if people used alternatives to Adobe software whenever possible.

Adobe response: For a hefty fee, we might fix it

[Anonymous Coward]

Adobe has a well documented lack of interest in fixing its bugs without charging its customers. For years now, Photoshop has ignored its placebo settings panel and attached itself to storage volumes despite the wishes of users (After three years, I can only assume the purpose is nefarious, and probably related to terrorism and or a desire to harm small animals). A spokesman claims the company has finally fixed the bug in CS6, but have told users they must http://feedback.photoshop.com/photoshop_family/topics/disk_could_not_be_ejected_because_photoshop_is_using_itpony up $800+ for the antidote. Most of us will never know whether it's fixed or not.

Re:Is there a tool that does *all* reader function

[cant_get_a_good_nick]

I'm aware of Preview, doesn't do cryptographic signing. Im asking if something does everything, Preview doesn't cut it.

Re:Easy enough

[Anonymous Coward]

PDF-XChange Viewer opens those PDF's without any problems (the free version atleast).

Solution: Setup Chrome As Default PDF Reader

[idealego]

Setting up Google Chrome as the default PDF reader is more secure, and it's one less program to update. To do so in Windows 7 just right click on a PDF file, click "open with", click "choose default program", click Browse, and Browse to the following file:
C:\Users\\AppData\Local\Google\Chrome\Application\Chrome.exe

Adobe Reader does have some features that Chrome lacks, but 95% of users will be perfectly fine with just Chrome.

Re:Solution: Setup Chrome As Default PDF Reader

[idealego]

Slashdot messed up the path name. Where you see the double slashes is obviously the user name.

Re:Solution: Setup Chrome As Default PDF Reader

[JDG1980]

Setting up Google Chrome as the default PDF reader is more secure, and it's one less program to update. To do so in Windows 7 just right click on a PDF file, click "open with", click "choose default program", click Browse, and Browse to the following file: C:\Users\\AppData\Local\Google\Chrome\Application\Chrome.exe

I had considered doing something like this, but I'm not at all sure I want Google to have full information on my reading habits. (I already have Chrome installed for Facebook only, since it can be assumed that anything done on Facebook has no privacy to begin with, and this stops Facebook from tracking me on my normal browser.)

Which javascript?

[bigtrike]

The javascript you can add to the PDF through a GUI or the javascript that you can embed into hex strings when writing a PDF file? The files are a hacky mix of text and binary. Some data types define their length, others have insane rules for end markers and escaping. Hex strings were originally pretty easy, but then they decided that they'd add javascript support into the parsing so you can constants that vary conditionally on the PDF version number. On top of that, you practically have to build a run time to render the PDF because of the complexity of its nested viewport stacks and viewport modifications that can be executed at any time in the PDF.

If that wasn't enough, they made it way more complicated when they hacked in support for JetForms (now known as LiveCycle), which is an XML language with poorly thought out data types and full of rendering hints that would be really useful if the documentation said more than "ignore these if you're not Adobe". If you want to save a PDF created with LiveCycle that a reader other than Acrobat can read, it's saved in both forms, resulting in a file that's 3x the size of a PDF.

Re:Which javascript?

[Eponymous Hero]

pdfs are supposed to be rich formatted text documents that can embed images, nothing more. by allowing document creators to embed javascript, they open this medium up to many of the same, and some unique, attack vectors. here's just one example that made the news: http://www.zdnet.com/blog/security/adobe-confirms-pdf-zero-day-attacks-disable-javascript-now/5119. the same poisoned pdfs when rendered through a pdf reader without javascript execution capabilities are harmless. it doesn't really matter how the bad javascript code got there (just that it can be executed if it is there), but your info about livecycle-produced pdfs is interesting.

Re:Which javascript?

[Em Adespoton]

..and I'd like to point out that the rendering hints in these forms have already been exploited by malware for executing malicious instructions on Windows and OS X. While Adobe hasn't documented it for third party users, it's trivial for malware attackers to fuzz the engine and discover methods of exploiting these features for their own use.

Interestingly, Apple got around some of this with their Preview app by treating any area of the display PDF that has a form-like decoration as if it were a form -- so LiveCycle PDFs are often viewable in Preview even though it doesn't really understand the defined structures. This also likely makes it resistent to many exploits targeting LiveCycle.

Adobe Reader is a huge BLOB - use Free software!

[MagicFab]

Use free open source software instead:
http://pdfreaders.org/

And also insecure

[Anonymous Coward]

You forgot to add:

-- insecure (like Adobe Reader, uses Javascript)

Any system that sends arbitrary 3rd party code to be executed on users' machine is a security nightmare by definition. We've known and taught that principle to youngsters for 30 years ... but the current generation of clueless webbies has forgotten it.

Re:Easy enough

[Anonymous Coward]

The reader is free at PDF Xchange and it does much much more than Adobe Reader.

Oooh oooh, can we do Flash next? Please! (nt)

[Anonymous Coward]

nt

hypocrits..

[SuperDre]

they act like adobe is bad, but knowing well that big companies work with structured development where everything has to be planned. it's almost only 1.5 month AFTER they notified adobe about the problems and they're already bitching at adobe.. It's not like all the reported (security) bugs about chrome are fixed within one month.. So I find it very irresponsible of them to publish the information so soon, to me it more seems them trying to blackball adobe...

Except That

[Anonymous Coward]

..all PS interpreters seem to be as buggy as hell. One exploit is enough to own your printer.

Re:Except That

[stoatwblr]

Or simply crash the damn thing. HP's PS interpreter is particularly prone to over-long headers (I notified them of the problem in 2002 and they promised to fix it. As of 2012 I can still reliably crash their printers - which is why we no longer buy them)

Giving an advertising company complete access?

[Anonymous Coward]

Are you serious? Chrome? NO-WAY! Don't run it.

The only thing worse than Adobe management's complete failure at handling this is how Google will take advantage of all that data they've been collecting from Chrome users. It might not happen this year, but we are learning more and more about google collecting data and keeping it for sometimes-creepy things. They have the data, you can't get it back.

Best to use Chromium if you like that sort of browser. Chromium is the F/LOSS on which project that Chrome browser is based.

Open Source PDF Renderers

[Anonymous Coward]

Most (all ?) open-source PDF viewers are based on libpoppler. So if that lib has issues, all (except ghostview-based) viewers will have the same issues. Libpoppler does not look exactly nice to me as a C++ developer, as they use void* pointers liberally without a real need IMO.

If libpoppler has issues they will certainly be different to Adobe. Adobe gives a rats a$$ about security and proper coding, which has been concluded by many security researchers. Normal people cannot inspect their code. Libpoppler can be inspected by everyone, which means it is almost certainly much more secure than Adobe stuff.

The problem is not PDF per se, but Adobe products. They have moved R&D to India in an attempt to boost profitability and with that they have destroyed their ability to fix these issues. Their reputation is on the bottom of the crap reservoir and they will die a deserved death quite soon, if the Chinese do not prop them up financially, as Adobe products are their most important Intrusion API.

Re:Adobe response: For a hefty fee, we might fix i

[ColdWetDog]

Adobe has a well documented lack of interest in fixing its bugs without charging its customers. For years now, Photoshop has ignored its placebo settings panel and attached itself to storage volumes despite the wishes of users (After three years, I can only assume the purpose is nefarious, and probably related to terrorism and or a desire to harm small animals). A spokesman claims the company has finally fixed the bug in CS6, but have told users they must http://feedback.photoshop.com/photoshop_family/topics/disk_could_not_be_ejected_because_photoshop_is_using_itpony up $800+ for the antidote. Most of us will never know whether it's fixed or not.

So they fix that particular bug, ignore the 100+ other bugs that have been hanging out since version 5 and create new bugs.

Hey, it's one way to make money.

Re:Easy enough

[king neckbeard]

True, but I don't think any clients have as bad of a track record as Adobe. Adobe is very bad at security.

sumatra for pdf

[johnwerneken]

don't need for my Ubuntu but it is fine for pdf on windows. Adobe has perpetrated a lot of dysfunctional and restrictive software, perhaps just say no to adobe. Sumatra pdf viewer has given me no grief at all. Also MS Office 2013 will enable Word to read/edit pdf files...

Use A Different Approach

[Anonymous Coward]

LaTeX or OpenOffice + pdflatex + GnuPG. That is a rock-solid solution and actually secure as opposed to the security theater of Ado$e.

Fucking Idiot

[Anonymous Coward]

YOU. Or are you Chinese intelligence and being pissed off all your nice exploits won't work anymore because Google did a modest amount of serious testing ?

basically the same as full disclosure

[Chirs]

Depending on how big foo() is, simply indicating where the vulnerability is may be enough to allow black hats to find it.

how would an ABI help security more than API?

[Chirs]

Why do you need a binary interface rather than a programming interface?

Re:how would an ABI help security more than API?

[jhol13]

Because it must stay stable to be of any use. When it is stable, it got to be designed, or it won't stay stable.

Re:how would an ABI help security more than API?

[Anonymous Coward]

Derrrrrrrrrrrrrrrrp.

Re:Easy enough

[Anonymous Coward]

PDF-XChange Viewer opens those PDF's without any problems (the free version atleast).

I don't see any support for Dynamic XFA Forms on their feature list at

http://tracker-software.com/pdf-xchange-products-comparison-chart

Can you supply any evidence for your claim?

Re:Is there a tool that does *all* reader function

[Anonymous Coward]

Does Scribus provide adequate encryption for you?

just a chrome ad

[nazsco]

Nothing here is new. I bet even the security findings

This is all a chrome advertisement.

"how to make people use our plugin instead of the free reader with lots of features?"

They only failed to realize that people that even uses pdf probably use "secret" for their email password

How to deal with PDF files(Windows)

[Fantasio]

For saving my time, my sanity and the health of my PC, I've tried to avoid dealing with Adobe bloatware as much as I could. Under Windows most PDF can be opened instantly with Foxit. It's free, it's fast and it works for 99% of the files. I keep Acrobat Reader on my PC "just in case". I never open PDF files with the browser plugin (I disabled it), I prefer to download the file to the desktop and view it offline. It's faster and safer. I'm using an old version of Foxit with no builtin javascript support and which is blocked with the firewall. If it complains, that indicates the presence of a script, and most often it's malware (doing this way saved my skin a few times), or at least a script used for nefarious purpose like trying silently to report to headquarters. For creating PDF files from documents, PDFCreator is very easy to use and satisfy most of my needs, and to create PDF documents from scans I use WinScan2pdf. My last tool for manipulating PDFs is PDFTK (for which a GUI can be found). All these tools are free and easy to use.

Re:Is there a tool that does *all* reader function

[93 Escort Wagon]

Right, I should've been more clear. It doesn't help people like you - but for most users, Preview does everything they need.

Re:Is there a tool that does *all* reader function

[kybred]

Also, I forgot about Reader until something asked me to update it. I promptly deleted it, but where did the updater spawn from?

I fired up Reader yesterday and it popped up that there was an update, so I told it to go ahead. Then a dialog came that that it needed to restart to finish the update. I clicked 'Restart' thinking that Reader was going to restart. No, it restarted my fscking PC! Reader needs to DIAF! And it's updater!

Fuck adobe

[Anonymous Coward]

Free yourself instead: http://pdfreaders.org/

The "useful tool" analogy doesn't really work

[dbIII]

The problem IMHO with Adobe is that their tool is flawed and they don't care. For example, their encryption, which they actually had someone put in jail for presenting a paper on, was identical to that used by Julius Caesar and a number of cut out codewheels for entertainment on the back of cereal boxes. It was a substitution code where each letter was replaced by a letter a set number of letters later in the alphabet - so solvable in under a minute by an average ten year old with one of those cereal box code wheels.
So that was one of their big secrets that Adobe insisted a man should be imprisoned for reverse engineering (Dmitry Sklyarov was held for several weeks before bail was granted). Of course a judge let him be released and go home to Russia a year before the full case over the suggested DMCA violation came to court, but it just shows how little Adobe really care about producing any sort of quality product and how much they care about their false front. They just care about milking their portion of a captive market instead of improving their products and, like Cisco last year, are not above abusing the legal system in a truly excessive way to hide their flaws.

Sumatra PDF for Windows folks

[SD-Arcadia]

If you're stuck on windows and are sick of Adobe and FoxIt (yes that's bloated now too), I recommend Sumatra. It's gotten really fast with launching and rendering now, and as a bonus will open your e-book formats which I find is a logical addition to a document viewer. As long as you don't actually need the Adobe magic forms, Sumatra is the better, sane solution to just view pdf's and similar.

Re:Easy enough

[Anonymous Coward]

Mozilla Firefox has a built-in PDF reader as well.

Google warns of using Adobe (Linux) Reader

[Anonymous Coward]

http://www.h-online.com/open/news/item/Google-warns-of-using-Adobe-Reader-particularly-on-Linux-1668153.html

http://h-online.com/-1668153

"Google warns of using Adobe Reader - particularly on Linux

On its August Patch Day, Adobe has fixed numerous critical memory-related bugs in Reader for Windows and Mac OS X â" but has chosen to overlook Linux users. The researchers who discovered the holes now fear that potential attackers could find enough clues to build an exploit by comparing the current Windows version of Reader with the previous one. This would leave Linux users defenceless. On top of that, even the patched versions still contain a total of 16 open security holes.

Google employees Mateusz Jurczyk and Gynvael Coldwind initially examined the PDF engine of the Chrome browser and discovered numerous holes. They then tested Adobe Reader and found about 60 issues that triggered crashes, 40 of which are potential attack vectors. When the two researchers reported their discoveries to Adobe, the company promised to provide fixes â" but also indicated that not all the holes would be closed on Patch Day in August.

On Tuesday, that is exactly what happened. Versions 10.1.4 and 9.5.2 were released for Windows and Mac OS X only. Even these patched versions are still vulnerable to 16 of the reported issues that affect Windows, Mac OS X or both systems. To prove this, the Google employees have released obfuscated information concerning the crashes. The security experts say that the unpatched holes could potentially be identified by third parties because they were found by modifying publicly available PDF documents.

Apparently, the researchers' threat to publish all vulnerability details online in accordance with "responsible disclosure" did not worry Adobe. The deadline is set for 60 days after the day on which the researchers informed Adobe about the holes: 27 August. However, Adobe told the researchers that no further updates are planned in that timeframe.

The Google employees therefore recommend that users refrain from opening any PDF documents from external sources in Adobe Reader. Those who use a browser other than Chrome can protect themselves by disabling the Reader's browser extension. The extension allows the holes to be exploited with a simple visit to a specially crafted web page.

Windows users who still use version 9 of Reader have been advised to upgrade to Adobe Reader X, because this version contains a sandbox that makes exploiting the holes more difficult. While Linux users can fix two of the holes by deleting the annots.api and PPKLite.api plug-ins from the /path/to/Adobe/Reader9/Reader/intellinux/plug_ins directory, this seems like a drop in the ocean when considering the total number of holes that riddle Reader for Linux."

Re:Easy enough

[Anonymous Coward]

Here you go:
http://www.tracker-software.com/PDFXV_history.html

And when in doubt, give it a try.