Slashdot Mirror
Security Researcher Drops 15 Vulnerabilities for Windows and Adobe Reader
mask.of.sanity writes: Google Project Zero hacker Mateusz Jurczyk has dropped 15 remote code execution vulnerabilities, including a single devastating hack against Adobe Reader and Windows he reckons beats all exploit defenses. He said, "The extremely powerful primitive provided by the vulnerability, together with the fact that it affected all supported versions of both Adobe Reader and Microsoft Windows (32-bit) – thus making it possible to create an exploit chain leading to a full system compromise with just a single bug – makes it one of the most interesting security issues I have discovered so far." Jurczyk published a video demonstration of the exploit for 32-bit and 64-bit systems. His slides are here [PDF].
Sorry, I am not clicking on a PDF link that demonstrates a PDF attack.
He dropped them from his to do list?
He was carrying them around and dropped them?
Slang for "He published them" ?
He dropped them from his research list?
He dropped the vulnerabilities from his own systems?
Apparently "Slashdot" means to "Slash" the English language with slang. Can we please "DROP" the amateur reporting styles?
Let's make like a bird... and get the flock outta here.
I wish I could do without Adobe Reader. I really wish I could.
Huge piece of bloated software. One of the largest virus vectors out there today. Unwieldy to deploy, manage. Filled to the brim with up selling features and advertisements. (Not as bad as Java, thankfully) You can fix a lot of that with group policies and Adobe's custom package generator but damn it's a pain in the as every time an update rolls out.
There are a lot of PDF alternatives now, but fuck it if Adobe hasn't sunk their hooks in so many large and govt orgs. Despite PDFs being a "standard" Adobe sells a lot of "solutions" that spit out PDFs laden with "features" that are only functional in Adobe Reader.
Can't even tell you how many calls I've gotten about PDFs that don't render in Chrome, having to explain they have to save the thing and launch it from their desktop.
"Curses! Foiled again!" says the NSA. Why in the heck aren't they doing this research again? Oh, because security is only for the strong.
(Sorry for the slightly off-topic post guys, but it really riles me up that people aren't doing their jobs)
So, if I assume there's been at least one monthly major security issue attributable to Adobe (maybe twice monthly, once for Reader and once for Flash) ... and if we extend that over the last decade or, it becomes pretty obvious that Adobe writes some shitty code.
I'm not sure a single software vendor on the planet, except Microsoft, has caused so much security holes in all of the history of computers.
Pity we couldn't bill them for all the wasted time and resources.
Lost at C:>. Found at C.
If you're still using Flash and Adobe Reader in 2015, you're just asking for trouble.
Get free satoshi (Bitcoin) and Dogecoins
Is there a good program that just *reads* without this constant useless updates and a 'need' for internet connection? Or should i just use an older version? Like 10 or 11?
I vote Adobe the worst software provider in terms of quality. We bash Microsoft quite a bit but think about it. Shockwave, Flash now Acrobat Reader must be the crappiest three pieces of software in terms of quality and vulnerabilities. I guess when you couple Adobe + Windows it's truly craptacular!
Harrison's Postulate - "For every action there is an equal and opposite criticism"
People still have Adobe Reader installed?
Lots of people...get out of your mom's basement or out from under your rock...
You're messin' with my Zen Thing, man.....
Where does OpenSSL fit into your story? No software is perfect, and assuming it is invites peril.
It would have been nice if The Register's somewhat hysterical FA (much less the Slashdot summary) had made clear up front that Microsoft patched most of the Windows vulnerabilities all the way back in March (MS15-021), and the last one in May (MS15-044). According to j00ru's blog post, Adobe patched their holes in May as well.
j00ru was clear enough in his blog post, but El Reg decided to stick in one line: "Microsoft and Adobe issued patches in three updates."—six paragraphs down, looking more like an image caption than part of the article. Sheesh.
I figure by 2030 or so my 6-digit UID will be something to brag about.
Before too long smart people will start using pencil and paper again.
Where is Windows fault in that? The version of Adobe PDF Viewer for Windows that has a bug...
same can be said for if you are still using windows... or heck anything connected to the internet period.
"Before too long smart people will start using pencil and paper again" for anything requiring security.
for social media... these tools are fine.
Pdf is a subset of PostScript, a turing complete programming language. It's most often used for rendering documents, but is in no way limited to that. You can program an emulator in ps and run Linux inside your pdf. Gif and jpeg are not executable code. They are just (compressed) color VALUES).
There was one security hole in one specific executable LIBRARY which processes jpegs, but jpegs themselves are not executable and therefore essentially safe. Not so for pdf.
It is hoped that pdf is slightly safer than pure PostScript, but it's not FUNDAMENTALLY safer.
Lots of people haven't upgraded from Adobe Reader.
We have work to do educating people.