Slashdot Mirror
Security Researcher Drops 15 Vulnerabilities for Windows and Adobe Reader
mask.of.sanity writes: Google Project Zero hacker Mateusz Jurczyk has dropped 15 remote code execution vulnerabilities, including a single devastating hack against Adobe Reader and Windows he reckons beats all exploit defenses. He said, "The extremely powerful primitive provided by the vulnerability, together with the fact that it affected all supported versions of both Adobe Reader and Microsoft Windows (32-bit) – thus making it possible to create an exploit chain leading to a full system compromise with just a single bug – makes it one of the most interesting security issues I have discovered so far." Jurczyk published a video demonstration of the exploit for 32-bit and 64-bit systems. His slides are here [PDF].
Sorry, I am not clicking on a PDF link that demonstrates a PDF attack.
He dropped them from his to do list?
He was carrying them around and dropped them?
Slang for "He published them" ?
He dropped them from his research list?
He dropped the vulnerabilities from his own systems?
Apparently "Slashdot" means to "Slash" the English language with slang. Can we please "DROP" the amateur reporting styles?
Let's make like a bird... and get the flock outta here.
So, if I assume there's been at least one monthly major security issue attributable to Adobe (maybe twice monthly, once for Reader and once for Flash) ... and if we extend that over the last decade or, it becomes pretty obvious that Adobe writes some shitty code.
I'm not sure a single software vendor on the planet, except Microsoft, has caused so much security holes in all of the history of computers.
Pity we couldn't bill them for all the wasted time and resources.
Lost at C:>. Found at C.
The NSA is an offensive organization
You could have just stopped there.
Time to offend someone
We installed Foxit Enterprise Reader and disabled in-browser PDF viewing for all browsers. This forces PDF downloads and everything displays wonderfully. It's lightning fast too!
Let's make like a bird... and get the flock outta here.
Why in the heck aren't they doing this research again?
They are, but when they find something, they add it to their arsenal and use it themselves instead of alerting anyone to the vulnerability. This fact was the subject of some hand-waving from the White House earlier in the year. There's a good chance NSA has known about several of these for a long time, which is a little disconcerting since the Adobe Type Manager exploit may date back to 1998.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
I use SumatraPDF. AFAIK it's the smallest windows PDF reader which is worth using, I believe it's smaller than Foxit. But it's been a while since I installed Foxit, so a comparison would take effort.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
It would have been nice if The Register's somewhat hysterical FA (much less the Slashdot summary) had made clear up front that Microsoft patched most of the Windows vulnerabilities all the way back in March (MS15-021), and the last one in May (MS15-044). According to j00ru's blog post, Adobe patched their holes in May as well.
j00ru was clear enough in his blog post, but El Reg decided to stick in one line: "Microsoft and Adobe issued patches in three updates."—six paragraphs down, looking more like an image caption than part of the article. Sheesh.
I figure by 2030 or so my 6-digit UID will be something to brag about.
Pdf is a subset of PostScript, a turing complete programming language. It's most often used for rendering documents, but is in no way limited to that. You can program an emulator in ps and run Linux inside your pdf. Gif and jpeg are not executable code. They are just (compressed) color VALUES).
There was one security hole in one specific executable LIBRARY which processes jpegs, but jpegs themselves are not executable and therefore essentially safe. Not so for pdf.
It is hoped that pdf is slightly safer than pure PostScript, but it's not FUNDAMENTALLY safer.