Slashdot Mirror
Security Researcher Drops 15 Vulnerabilities for Windows and Adobe Reader
mask.of.sanity writes: Google Project Zero hacker Mateusz Jurczyk has dropped 15 remote code execution vulnerabilities, including a single devastating hack against Adobe Reader and Windows he reckons beats all exploit defenses. He said, "The extremely powerful primitive provided by the vulnerability, together with the fact that it affected all supported versions of both Adobe Reader and Microsoft Windows (32-bit) – thus making it possible to create an exploit chain leading to a full system compromise with just a single bug – makes it one of the most interesting security issues I have discovered so far." Jurczyk published a video demonstration of the exploit for 32-bit and 64-bit systems. His slides are here [PDF].
Sorry, I am not clicking on a PDF link that demonstrates a PDF attack.
He dropped them from his to do list?
He was carrying them around and dropped them?
Slang for "He published them" ?
He dropped them from his research list?
He dropped the vulnerabilities from his own systems?
Apparently "Slashdot" means to "Slash" the English language with slang. Can we please "DROP" the amateur reporting styles?
Let's make like a bird... and get the flock outta here.
I wish I could do without Adobe Reader. I really wish I could.
Huge piece of bloated software. One of the largest virus vectors out there today. Unwieldy to deploy, manage. Filled to the brim with up selling features and advertisements. (Not as bad as Java, thankfully) You can fix a lot of that with group policies and Adobe's custom package generator but damn it's a pain in the as every time an update rolls out.
There are a lot of PDF alternatives now, but fuck it if Adobe hasn't sunk their hooks in so many large and govt orgs. Despite PDFs being a "standard" Adobe sells a lot of "solutions" that spit out PDFs laden with "features" that are only functional in Adobe Reader.
Can't even tell you how many calls I've gotten about PDFs that don't render in Chrome, having to explain they have to save the thing and launch it from their desktop.
"Curses! Foiled again!" says the NSA. Why in the heck aren't they doing this research again? Oh, because security is only for the strong.
(Sorry for the slightly off-topic post guys, but it really riles me up that people aren't doing their jobs)
"Google Project Zero hacker Mateusz Jurczyk has dropped 15 remote code execution vulnerabilities, including a single devastating hack against Adobe Reader and Linux he reckons beats all exploit defenses."
Two swiss cheeses...
Anyone else notice that adobe was running with system privs? Mine runs at medium for the main exe with low for the child exe, I'm not sure what's up with that demo.
He's a "hacker", therefore he has no rights but is dangerous and needs to be locked up. Judges agree with this.
What, you don't like knee-jerk reactions? Then stop pavlov-training the world by calling everything "hack" and everyone "hacker".
15 vulnerabilities in Adobe that allow you to attack at the OS level.
Always a spin.
So, if I assume there's been at least one monthly major security issue attributable to Adobe (maybe twice monthly, once for Reader and once for Flash) ... and if we extend that over the last decade or, it becomes pretty obvious that Adobe writes some shitty code.
I'm not sure a single software vendor on the planet, except Microsoft, has caused so much security holes in all of the history of computers.
Pity we couldn't bill them for all the wasted time and resources.
Lost at C:>. Found at C.
We know, we know...you're suggesting that the (insert OS here) that you're using is superior. Personally I think that TI-99 you typed your flame bait from is a POS!
If you're still using Flash and Adobe Reader in 2015, you're just asking for trouble.
Get free satoshi (Bitcoin) and Dogecoins
Is there a good program that just *reads* without this constant useless updates and a 'need' for internet connection? Or should i just use an older version? Like 10 or 11?
I vote Adobe the worst software provider in terms of quality. We bash Microsoft quite a bit but think about it. Shockwave, Flash now Acrobat Reader must be the crappiest three pieces of software in terms of quality and vulnerabilities. I guess when you couple Adobe + Windows it's truly craptacular!
Harrison's Postulate - "For every action there is an equal and opposite criticism"
People still have Adobe Reader installed?
Lots of people...get out of your mom's basement or out from under your rock...
You're messin' with my Zen Thing, man.....
Where does OpenSSL fit into your story? No software is perfect, and assuming it is invites peril.
15 bugs in 2 products is probably a new low, even for ms and adobe.
There is no reason to think that there are not many more.
Why can we not have simpler s/w which is robust?
Economics seems to be driving the industry in the wrong direction.
Before too long smart people will start using pencil and paper again.
Where is Windows fault in that? The version of Adobe PDF Viewer for Windows that has a bug...
same can be said for if you are still using windows... or heck anything connected to the internet period.
"Before too long smart people will start using pencil and paper again" for anything requiring security.
for social media... these tools are fine.
Pdf is a subset of PostScript, a turing complete programming language. It's most often used for rendering documents, but is in no way limited to that. You can program an emulator in ps and run Linux inside your pdf. Gif and jpeg are not executable code. They are just (compressed) color VALUES).
There was one security hole in one specific executable LIBRARY which processes jpegs, but jpegs themselves are not executable and therefore essentially safe. Not so for pdf.
It is hoped that pdf is slightly safer than pure PostScript, but it's not FUNDAMENTALLY safer.
Lots of people haven't upgraded from Adobe Reader.
We have work to do educating people.
The research has dropped 15 vulnerabilities? What does that mean? They did have the vulnerabilities but have now discarded them?
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife