Adobe Warns of Reader, Acrobat Attack

itwbennett writes "Monday afternoon, Adobe 'received reports of a vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions being exploited in the wild,' the company said in a post to the company's Product Security Incident Response Team blog. According to malware tracking group Shadowserver, the vulnerability is due to a bug in the way Reader processes JavaScript code. Several 'tests have confirmed this is a 0-day vulnerability affecting several versions of Adobe Acrobat [Reader] to include the most recent versions of 8.x and 9.x. We have not tested on 7.x, but it may also be vulnerable,' Shadowserver said in a post on its Web site. The group recommends that concerned users disable JavaScript within Adobe's software as a work-around for this problem. (This can be done by un-checking the 'Enable Acrobat JavaScript' in the Edit -> Preferences -> JavaScript window). 'This is legit and is very bad,' Shadowserver added."

Does it run Linux?

[filesiteguy]

Normally that would be my first response as a joke, but I begin to wonder if Adobe could affect anything that is not root-level (or admin level).

BUT WAIT!!!!

[Monkeedude1212]

No one uses Adobe Reader for anything other than business PDF's.

Seriously, The launch time for a PDF off the web is too large for me to bother. First it's gotta download that 7 Meg file, then Adobe's gotta kick start, and then it doesn't let me highlight anything to keep me from copying and pasting.

Seriously - I have only ever seen PDF's used at work and at school, and anywhere else they exist usually aren't worth the bother.

So who are the people taking advantage of these vulnerabilities?

Why javascript in a pdf reader?

[140Mandak262Jamuna]

It is high time people stop using any pdf reader that uses javascript or opens external links or does anything other than simply render the document on screen. Editable pdf, where one can fill in the fields etc must be a separate application, not plugged into the browser. I feel safe with NoScript controlling FireFox. Hope someone comes up with a good general purpose sandboxer that will sandbox every plug-in.

Re:Anyone still has JavaScript enabled?

[jasonwc]

I agree. These security vulnerabilities appear to be a weekly occurrence. Anyone that hasn't disabled Javascript in Reader/Acrobat at this point either doesn't care about the numerous vulnerabilities or doesn't understand the risks involved.

The bigger question is why Adobe doesn't just disable Javascript by default. I have never used a PDF that required Javascript and I've dealt with a number of user-fillable forms. So, what exactly is Javascript being used for? I know that it has some use. However, it seems that the security risk is far greater than any potential benefit of the "feature".

Re:BUT WAIT!!!!

[betterunixthanunix]

Acrobat and Reader are bloated. Try something a little lighter like XPDF or Okular.

Re:Adobe still used why?

[COMON$]

I would love a good alternative personally. All my users do is read the PDFs and we use PDFCreator for merging documents. I just havent found one that seems to be solid enough for the enterprise push. Any recommendations from people who have made the switch? I am getting tired of patching every 5 minutes.

Re:BUT WAIT!!!!

[jasonwc]

Half of my readings in Law School are scanned documents/books in PDF format. Many of the documents are 25-40 MB in size and several hundred pages. I find that PDFs actually load very quickly - much faster than a similarly sized Word or Open Office document, and easier to read. Of course, you can use any PDF reader and not just Adobe Reader/Acrobat.

On my Core 2 Duo and Core i7 systems, I can open PDFs pretty much instantaneously (less than 0.5 seconds). The only delay is the download. Thankfully, this is one area where Comcast's 25 Mbit "Speedboost" actually comes in handy. At school, being able to download at 100 Mbit/sec makes the files load even faster. The only issue is that Adobe Reader sometimes stalls and I have to try again. However, I find the Adobe reader plugin to generally work better than the alternatives, and I like the full screen reader. I've used Foxit for the tab support but I prefer Reader for its menu layout simplicity when I don't need many documents open.

Re:Anyone still has JavaScript enabled?

[wkk2]

JavaScript in PDFs has always been trouble. I use forms that auto complete, add columns, etc. A compromise might be a default of prompt before running scripts with a recommend/default of "no". I'd always click "no" unless I trusted the source. Since that would marginalize the product it will probably never happen. I wish I had never upgraded from 4.

Re:Anyone still has JavaScript enabled?

[digitalhermit]

It's easy enough to disable, but everytime a doc gets loaded with embedded JS, the reader will prompt to enable it with a message saying something like "the document may not display correctly" without it enabled. Clicking the "yes" will then re-enable it. The problem with this approach is that we get so many warnings that people may automatically start enabling JS accidentally.

Re:Javascript Again

[JeffSpudrinski]

I have javascript disabled at each user login on our network (through the logon script), just in case someone has re-enabled it when their system was last logged on. I haven't found a way to totally lock it out yet.

The huge problem is that Adobe offers to enable javascript for users when they open a PDF with Javasript in it. It displays a message along the lines of "you're not seeing everything here unless you enable javascript...click here to enable it" with a big friendly "YES" button. Kind of defeats the purpose when it's made so easy for users to re-enable.

I warn users not to enable it, but most either don't care or don't pay attention...and at least 80% of them will always click "YES" or "OK" just to get a message box to go away without reading it. (Invariably followed by a tech call stating "I clicked OK on something...what's wrong with it and why don't you know off the top of your head what I did wrong?")

Nice of Adobe to make it so helpful and user-friendly to re-enable the most dangerous part of their software.

-JJS

Re:Really...

[Deagol]

> A spreadsheet app is also substantially larger than a PDF reader.

This *is* Adobe we're talking about here. For grins, I just installed Adobe Reader 9.2 and Gnumeric 1.9.16 on a XP VM, and for the informal survey of the "Program Files" directory, Adobe (203MB) weighs in at almost twice that of Gnumeric (106MB).

I vote for using the best app for the job. In the case of this thread, I wholeheartedly think the spreadsheet is that tool.

Re:Really...

[lahvak]

No, PDF format is a crippled postscript. It was intentionally crippled so it will NOT be a language, because distributing documents written in a programming language was not secure. Then they realized they crippled it too much, and added javascript to it. It is an improvement, since the scripts are localized in the document, easier to identify, they can be disabled if you want to, etc.

I think in general having scripting language embedded into an interactive document format is a good idea, however, it seems that Adobe's implementation is rather buggy and badly designed.

Re:Why javascript in a pdf reader?

[StuartHankins]

The companies which require this functionality have already decided to use the market leader's product. Since you have absolutely no way of convincing them all to switch to something else, perhaps you should be the one to look for alternative solutions.

You had a niche application, WYSISWYPrint. Try to compete with the swift, quick to load, quick to render competition or you will be lost in the netherworld between browsers and pdf renderers.

If anything, the PDF standard is increasing usage worldwide. PDF is a very well documented standard -- I speak as someone who wrote a program to create PDF files with images and form fields from scratch using VB 6 with no plugins -- so go ahead and create your own reader, market it and make it the #1. Nothing's stopping you.