Forum Moderators: phranque
A zero-day PDF vulnerability in Adobe's Acrobat Reader has come to light that can lead to Windows boxes getting taken over completely and invisibly, according to a security researcher. "All it takes is to open a [maliciously rigged] PDF document or stumble across a page which embeds one,"
Adobe provides facilities to convert PDF to text and to web-formats [adobe.com] - these could become a key part of PDF viewing in the near future. Email versions exist (forward to pdf2txt@adobe.com or pdf2html@adobe.com to get text or html conversions back).
For those who actually need to open the PDF before this is properly patched, be aware that the free download 'GSview' is a alternative viewer (requires ghostscript, also free download). For safety, uninstall Adobe's reader entirely first. Note that as there is no published POC it is not yet possible to be sure if any alternative viewer is safe. Perhaps converting the PDF to a Postscript file before viewing should be recommended?
Finally, if the PDF is on a website, try to use Google's HTML version feature - search by the PDF's URL and see if there's an HTML link there.
It does seem very worrying, especially considering Adobe's reponse. The notes about social engineering are spot on. I've opened PDF spam myself before. I suggest that care is taken with even trusted PDF files as it is likely that anyone exploiting this will attempt to infect other PDF files on the host system in the hope that they will be sent elsewhere.
In the end it does seem likely that repeated security flaws revolving around 'internet enabled' applications will mean we are going to see a return to the strict segregation of the internet and our applications of the type we saw five years ago due to technical limitations. If this problem continues I can't see it remaining acceptable for a media player to be able to do anything but pure streaming, or for a word processor to browse websites 'inline'.
we are going to see a return to the strict segregation of the internet and our applications of the type we saw five years ago due to technical limitations. If this problem continues I can't see it remaining acceptable for a media player to be able to do anything but pure streaming, or for a word processor to browse websites 'inline'.
I used to run my web browser (and therefore any applications it launched) as a separate user. This is a better solution as it allows you to use applications both ways, but to restrict the vulnerable usage. I stopped doing it due to the lack of attacks that affected Linux, but I will start again if things change.
Does this mean we should take PDFs off of our sites until the whole thing is resolved?
I would say that is an overreaction. After all, if you are not malicious, and your server has not been compromised, your PDFs are safe.
If you have a lot of PDFs on your site, point people to other PDF readers, so they can feel secure (if they know about this). If everyone did this, it would give Adobe an incentive to patch quickly.
Almost everyone using a non-Windows platform, and enough Windows users to make the software worth producing, use other PDF readers already.
There is one person -who unfortunately shared it with his friends, but not widely (yet)- who knows how to attack using this alleged vulnerability (it's not been proven, nor independently verified, nor confirmed (publicly) by adobe).
Stopping the use of pdfs is about the worst possible choice at it'll drive you right towards formats such as word's ".doc". Much more vulnerabilities there, and much less platform independent.
I remember a while back that it was noticed that at that time over the past 2 years there were just a dozen or so days that there was not a publicly known unpatched buffer overflow in Microsoft's IE. Did it yield in an abandonment of IE? Did you switch to an alternate browser/vendor?
Yet, those were -as a threat- much worse in each and every instance as the vulnerability (and the exploits) were known.
As Douglas Adams says: Don't Panic.
Unless you work for Adobe, those we want to work very hard and fix it *now*.
Don't overreact.
For commerical users, I would firmly recommend removal of Adobe Reader today from all machines, and keeping it gone until the patch is released. Rig up a machine on your intranet with a file upload form which uses ghostscript + imagemagick to convert the PDF to PNG and require all employees to use that to read their PDFs.
This sounds like another scare story to whip up hysteria to me.
Matt
I find the existence of all the various buffer-overrun/data-execution vulnerabilities (that's probably what the new Acrobat one is) absolutely gobsmacking. Speaking as a programmer, I have to say the code has to be pretty damn dirty at a memory-management level. This would also explain why fixes can be slow to arrive - dirty code is a lot more difficult to fix than clean code.
Data Execution Prevention
If this is a buffer-overrun/data-execution issue, I presume some of us are protected. In XP, this feature is only enabled by default for critical Windows services. If you wish to switch this feature fully on, right-click My Computer select, properties and then Advanced¦Performance¦Data Execution Prevention. Some legit programs will fail with this feature turned on so you can create exceptions.
Data-execution exploits work by embedding program code into partially fake objects, such as image files. This is easy, the tricky part is inducing that program code to be executed. It is the actual execution of the rogue code that should be prevented by this Windows/Hardware facility.
Kaled.
Kaled.
Marshall
Bottom line - Trust! If you do not trust, or know the source, then do not open it.
It is NOT a PDF security hole, it is an Acrobat on Windows security hole.
I am not just splitting hairs. OK, most people use Acrobat to read PDFs: but by making the distinction clear you draw people's attention to the fact that they can avoid the problem by using another reader OR by using another platform.
but by making the distinction clear you draw people's attention to the fact that they can avoid the problem by using another reader OR by using another platform.
At first she couldn't open the file - when it did open, it immediately crashed her system. Ten minutes later, company server system crashed. Possibly coincidence. Possibly not. They seem to have restored both her machine and the company servers - no details yet.
Is there anywhere that one can safely send a file of unknown risk, and find out if is a threat, or if all is just coincidental?
Deleted file, emptied trash. Deleted email, emptied trash. But I still have a copy of this email and PDF on remote server. Occasionally have need to monitor company email and use a Hotmail account do so without having all that junk come into my own machine. Just do 'batch' deletions.
I'm fully updated with XP, AVG, SprywareBlaster, Spybot, and AdAware. Ran full scans and 'seem' clean, but I've seen baddies get past all of this a couple of times in the past and it made my life hell for days both times.
Kaled.
