Slashdot Mirror
Google Employees Find 60 Security Holes In Adobe Reader
sl4shd0rk writes "Upon examining the PDF Engine behind Google Chrome, Google employees Mateusz Jurczyk and Gynvael Coldwind discovered numerous holes. This led them to also test Adobe Reader, which turned up around 60 holes which could crash the PDF reader, 40 of them being potential attack vectors. The duo notified Adobe, who promised fixes, but as of the latest updates (Tuesday of this week) for Windows and Macintosh, 16 of the reported flaws are still present (the Linux version has been ignored). To prove it, Mateusz and Gynvael obfuscated the info and released it, saying the unpatched holes could easily be found. The Google employees therefore recommend that users refrain from opening any PDF documents from external sources in Adobe Reader."
PDFs have been a security headache for decades now. It originally started as an evolution of PostScript, but has since morphed into a "document solution". Adobe, like so many tech businesses, can't simply create a tool and then be finished. They always have to add more features, more code, more bloat. And surprise surprise, problems arise.
When I go to work on my car, I know my ratchets will work on any bolt on it; I just need to figure out what size it is and maybe an extender and I'm in business. My tools just work; they rarely break, and they don't stop working with next year's model... or the next decade's. Or the last. My ratchets will work on 1950s model cars, and I'm sure they'll still be useful on a 2050 model car.
Linux is more like my ratcheting set. Sed, awk, bash scripts... they don't change. They were there 5 years ago. They'll be there 5 years from now. They're simple, dependable, and "just work". What the fuck is so hard about making a read-only flat document that does the job of being easily readable and printable well? Stop adding features. Make the product do one thing well, and then use the profits to make a completely different product if you need something else done well.
Be like the ratchet.
#fuckbeta #iamslashdot #dicemustdie
Google announces a new initiative: Google Document Format, for all your document sharing needs.
"Engineering is the art of making what you want from things you can get" - Jerry Avins
>Adobe in charge of security.
Google was irresponsible in not publishing these holes immediately so affected users could take steps to mitigate their vulnerability while Adobe put together a patch.
Give me Classic Slashdot or give me death!
Those fucking slackers could only find 60 holes in that Swiss cheese? And, they couldn't even bother looking at Flash!
Oops, I have to go. My PC needs to reboot after the third Flash and Reader update today.
30 EUR for a single license for "PDF-XChange Viewer" and you get only "1 year of product maintenance" (which probably means after one year you need to pay for security patches).
For a freaking pdf reader? And with no real assurance that this one isn't again full of security holes. Get real.
The summary muddles two distinct PDF readers, the PDF reader built into the current version of Chrome (purely Google) and the PDF reader from Adobe that's completely separate. The Google reader is relevant only because the vulnerabilities in the Adobe reader were discovered using the tools developed to find vulnerabilities in Chrome.
Ahem
It's got commenting features without watermarking and even does OCR which I have been very impressed by.
Because it's a proper noun.
In Ubuntu (and probably other distributions and gnome based desktops) the default viewer is Evince, in KDE ones is Okular, and you have embedded viewers in other apps, like in google chrome. There is no need to install Adobe's unless you need some special added feature. A list of software that works with PDF can be found in Wikipedia
Google was irresponsible in not publishing these holes immediately so affected users could take steps to mitigate their vulnerability while Adobe put together a patch.
The Full Disclosure folks say that vulnerabilities should be disclose immediately. Their arguments have some merits. The Responsible Disclosure folks say that the vendor should have n number of weeks to get a patch out, then it goes to Full Disclosure. That has some merits as well, but the trouble is the public doesn't know there's a problem during the n weeks. The calculation is a balance of how many people will be protected vs. how many people will be harmed.
It occurs to me that a third way, call it 'Informed Disclosure' for now, would be to:
as a way to avoid the problem with Responsible Disclosure but still give the vendor reasonable time to react. e.g. 'Informed Disclosure' may say:
and then send Adobe the exploit code, which will be published in 45 days. This also removes the illusion of potential blackmail from security researchers, because the public has on-record information that the disclosure will be published, regardless of the action or inaction by the vendor.
Surely others have taken this approach, but I can't find a name attached to it -- anybody?
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
The javascript you can add to the PDF through a GUI or the javascript that you can embed into hex strings when writing a PDF file? The files are a hacky mix of text and binary. Some data types define their length, others have insane rules for end markers and escaping. Hex strings were originally pretty easy, but then they decided that they'd add javascript support into the parsing so you can constants that vary conditionally on the PDF version number. On top of that, you practically have to build a run time to render the PDF because of the complexity of its nested viewport stacks and viewport modifications that can be executed at any time in the PDF.
If that wasn't enough, they made it way more complicated when they hacked in support for JetForms (now known as LiveCycle), which is an XML language with poorly thought out data types and full of rendering hints that would be really useful if the documentation said more than "ignore these if you're not Adobe". If you want to save a PDF created with LiveCycle that a reader other than Acrobat can read, it's saved in both forms, resulting in a file that's 3x the size of a PDF.