Slashdot Mirror
Security Researcher Drops 15 Vulnerabilities for Windows and Adobe Reader
mask.of.sanity writes: Google Project Zero hacker Mateusz Jurczyk has dropped 15 remote code execution vulnerabilities, including a single devastating hack against Adobe Reader and Windows he reckons beats all exploit defenses. He said, "The extremely powerful primitive provided by the vulnerability, together with the fact that it affected all supported versions of both Adobe Reader and Microsoft Windows (32-bit) – thus making it possible to create an exploit chain leading to a full system compromise with just a single bug – makes it one of the most interesting security issues I have discovered so far." Jurczyk published a video demonstration of the exploit for 32-bit and 64-bit systems. His slides are here [PDF].
We installed Foxit Enterprise Reader and disabled in-browser PDF viewing for all browsers. This forces PDF downloads and everything displays wonderfully. It's lightning fast too!
Let's make like a bird... and get the flock outta here.
It would have been nice if The Register's somewhat hysterical FA (much less the Slashdot summary) had made clear up front that Microsoft patched most of the Windows vulnerabilities all the way back in March (MS15-021), and the last one in May (MS15-044). According to j00ru's blog post, Adobe patched their holes in May as well.
j00ru was clear enough in his blog post, but El Reg decided to stick in one line: "Microsoft and Adobe issued patches in three updates."—six paragraphs down, looking more like an image caption than part of the article. Sheesh.
I figure by 2030 or so my 6-digit UID will be something to brag about.
You still use NoScript?
uMatrix is available for Firefox now.
Goodbye NoScript. Goodbye RequestPolicy. Goodbye CookieSafe. uMatrix does it all and does it better.
Your web browser is a dog. uMatrix is its leash.
It's available for Chrome as well.
Pdf is a subset of PostScript, a turing complete programming language. It's most often used for rendering documents, but is in no way limited to that. You can program an emulator in ps and run Linux inside your pdf. Gif and jpeg are not executable code. They are just (compressed) color VALUES).
There was one security hole in one specific executable LIBRARY which processes jpegs, but jpegs themselves are not executable and therefore essentially safe. Not so for pdf.
It is hoped that pdf is slightly safer than pure PostScript, but it's not FUNDAMENTALLY safer.