Microsoft Helps Adobe Block PDF Zero-Day Exploit 93
CWmike writes "Microsoft has urged Windows users to block ongoing attacks against Adobe's popular PDF viewer by deploying one of Microsoft's enterprise tools. Adobe echoed Microsoft's advice, saying the Enhanced Migration Experience Toolkit (EMET) would stymie attacks targeting Reader and Acrobat. Called 'scary' and 'clever,' the in-the-wild exploit went public last week when security researcher Mila Parkour reported it to Adobe after analyzing a rogue PDF document attached to spam. Adobe first warned users Wednesday of the threat, but at the time gave users no advice on how to protect themselves until a patch was ready. Microsoft stepped in on Friday. 'The good news is that if you have EMET enabled ... it blocks this exploit,' said Fermin Serna and Andrew Roths, two engineers with the Microsoft Security Response Center in an entry on the group's blog."
A Symantec blog post suggests the people exploiting this vulnerability may be the 'Aurora' group responsible for the attacks on Google late last year.
Re: (Score:2)
When Micosoft does something that isn't evil, it's considered news?
MS, Adobe, and a new virus walk into a bar ... and the punchline is the word 'scary' isn't applied to using MS products. Although it scares the hell out of me, being a strictly Linux/Mac guy.
Adobe's perspective (Score:5, Insightful)
This has nothing to do about MS being good or evil. They've got a solution to the problem and it's much welcomed. Hopefully Adobe gets this fixed shortly so that people who can't make use of Microsoft's solution don't have to worry about the vulnerability either.
Re: (Score:1)
This has nothing to do about MS being good or evil. They've got a solution to the problem and it's much welcomed.
Solving it helps them, too. Note MS didn't suggest simply replacing Adobe with some other company's PDF reader instead of MS software. It makes MS look like they're good at security.
Microsoft -- the DHS of software. "It's all about the look and feel."
Re: (Score:2)
I don't see how this turns into "someone else cleaning up your mess while you stand around, thumb up ass." Any security fix takes time -- the question is how fast should the response be? If your argument that 3 weeks is too long, that would certainly be a valid opinion. (Adobe's bulletin notes they a
Re: (Score:1)
I wonder if this was M$ who thought up another way to exclude all non legit copies to NOT get the much needed fix.
Sure just pay money to get a legit copy, or move to linux to avoid paying for an OS...I am sure there are many out there who would appreciate M$ offering free updates EVEN FOR NON LEGIT copies, as this would definitely make me rethink my M$ is evil methodology, however, it would also lend a much needed hand at securing more of the internet that is still vulnerable and responsible for most spam t
Re:What does it say about your company... (Score:5, Insightful)
This is /. Anything related to computer security is news. Especially when it effectivaly targets most, if not, all the users/customers we have to help all day (and night, and weekends!).
Not every story about Microsoft is posted just because it's about Microsoft.
Re: (Score:2)
We're a Linux shop, you insensitive clod!
Re:Its not zero day ... (Score:5, Informative)
When you're well past a week old, why the fuck do you keep calling it 0 day?
Because it was exploitable on day zero. It's a week old zero day exploit.
Re: (Score:1, Funny)
Look, naming conventions change over time and I'm not so sure it ever meant what you seem to think it meant anyway. In this context "0 day" means there are no known fixes for the problem. In other words it has been 0 days since a fix was released.
Re: (Score:2)
Look, naming conventions change over time and I'm not so sure it ever meant what you seem to think it meant anyway. In this context "0 day" means there are no known fixes for the problem. In other words it has been 0 days since a fix was released.
It did mean that, at one time. Zero-day meant that it was still unpublished... still secret. You had an exploit that was going to work because "nobody" knew about it. That is, nobody but you and others who had elite access to the BBS' filez. Now the industry has shifted the term to mean that the vulnerability is unpatched. Which, I suppose, has a lot of the same general meaning. Although I think it's lost a lot of the edge; big difference between unpatched and (relatively) unknown.
But then - this is a
Re: (Score:2)
Re: (Score:2)
I mean hell, in the IT world, a couple of examples are "megabyte" which somehow now means 1000^2 bytes now, instead of the 1024^2 that it has meant forever (or as long as I have been alive). "Alpha" software used to be "still in design phase" and Beta used to m
Re: (Score:3, Funny)
hope "bacon" doesn't come to mean something else
Do you mean regular bacon or Canadian (which is really ham)?
Re: (Score:2)
hope "bacon" doesn't come to mean something else
Do you mean regular bacon or Canadian (which is really ham)?
Or Turkey bacon. Which stills makes me think for a second or two when ever I hear or see it.
Re: (Score:2)
Do you mean regular bacon or Canadian (which is really ham)?
Kevin Bacon [wikipedia.org] is Canadian? I thought he was American?
Re: (Score:1, Interesting)
Sliced cheese now means pasteurized prepackaged cheese product...
Also, your megabyte example is more of a 'coming back' if you ask me, as Mega- is the standard prefix for 1000^2x. It was only in computers where it meant any other multiplier.
Re: (Score:1)
Only in the USA. Everywhere else (even Canada) it means real cheese sliced into ... slices.
Re: (Score:2)
I mean hell, in the IT world, a couple of examples are "megabyte" which somehow now means 1000^2 bytes now, instead of the 1024^2 that it has meant forever (or as long as I have been alive).
It still means what it used to meant, unless you're a drive maker. They did get a committee to muddle the water in order to avoid lawsuits, but that doesn't change the meaning of a term that's well-established for sixty years.
The few places that do use it do have bad effects. In facts, "MiB" for most IT professionals who haven't heard of that committee's revelations sounds like "millions of bytes", bringing confusion. Plain old "MB" doesn't have that flaw as long as drive labelling is not concerned.
Re: (Score:2)
> I mean hell, in the IT world, a couple of examples are "megabyte" which somehow now means 1000^2 bytes now, instead of the 1024^2 that it has meant forever (or as long as I have been alive).
Which is kind of funny given how the prefix mega had meant 10^6 for a really long time before that, including the telco world and the bits it moved around.
Re: (Score:1)
Historically, audio telephony had a sampling frequency 8 kHz.
As we went digital, G711 audio channels and ISDN B channels were 64000 b/s for 8-bit audio. Other codecs shrank that to 32000 b/s, 16000 b/s, etc. ISDN D channels were 16000 b/s. ISDN PRI channels were variously 1544000 b/s or 2048000 b/s. All the fat pipes carrying data aro
Re: (Score:1)
Re: (Score:1)
Re: (Score:2, Funny)
Re: (Score:2)
I'm not sure that's correct? I thought it was a Zero Day attack if on the day the attack occurred, the problem was not yet known.
Zero Day:
1) People start receiving emails with engineered PDFs that take advantage of the flaw.
2) Adobe discovers the flaw.
Not Zero Day:
1) Adobe discovers (and typically announces) a potential vulnerability
2) The next day, people start receiving emails with engineered PDFs that take advantage of the flaw.
Re: (Score:2)
From TFSummary:
Reads like Parkour reported an exploit being used actively in the wild to Adobe, to me. Which would make the sequence of events (1), (2), and this a zero day exploit. Silly term in any case, the relevant terms are, imo, "fixed" and "ongoing."
I already fixed mine (Score:5, Insightful)
I ununstalled Adobe Reader and installed Foxit. Problem solved!
'I'm smug and condescending just to be an asshat!' (Score:3, Informative)
What's your point?
At least 'mcgrew' offered a possible solution...so, where's your 'help the rest of the world' solution?
Put up, or shut up, you hypocrite.
You are actively working against your implied cause.
I also use Foxit, and learned about it years ago right here on /., from someone like 'mcgrew', making a similar comment.
The only benefit I got from your comment is you are an asshat, just for the sake of being an asshat.
To quote Fark (Score:2)
"This."
Seriously, Foxit is the way to go unless you have a reason. If you can't think of one, then yo don't have one :). There are things Foxit doesn't do or documents it has problems with but for normal users it is exceedingly unlikely you encounter it. The thing is much lighter weight and seems to have few security issues. Maybe it is just because nobody is looking, but regardless.
I was so glad when I found it for rolling out in our instructional labs. I got sick of having to do an update for Acrobat ever
Re: (Score:1)
I installed Foxit, and every time I clicked a PDF link in FireFox, the disk would churn for 5 minutes and everything else running in the browser would come to a halt. It made Acrobat Reader fleet-footed by comparison.
Re: (Score:3, Insightful)
As long as you don't assume it's a panacea... Foxit has had its own security exploits in the past.
Re: (Score:3, Informative)
Re: (Score:2, Informative)
Re:I already fixed mine (Score:4, Insightful)
Toolbars? Search engines? Are we talking about the same program here?
Yes.
It wants to install the Foxit Search Bar powered by Ask (opt-out)
It wants to set ask.com as your home page (also opt-out)
I just downloaded the most recent zipped version for Windows last night, and it didn't even need an installer.
Right. That's hardly how most people install the software.
Past versions that I've used the installer version of, had a rather obvious checkbox that you could use to opt out of installing a toolbar.
Oh, so you know all about the toolbar crap, and you are just being disingenuous. Classy.
Bottom line this sort of behaviour is skirting the border of being malware. What percentage of users appreciate another toolbar being crammed into their browser? What percentage of users appreciate their home page being changed? When both are pretty close to zero, you don't make it OPT-OUT in your installation wizard. Its especially obnoxious when users have to keep opting out each time they install an update.
Having an opt out toolbar or home page change as part of the default install is obnoxious enough for me to avoid recommending foxit. Too many people will end up with them and none of them will appreciate it.
Re: (Score:1)
I've always used Foxit and it gives me a very clear option to not install anything extra. If I ended up with a toolbar or anything else unwanted from it it would be my own damn fault.
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
So you stalled (froze) Adobe Reader? :P
Re: (Score:3, Informative)
Re: (Score:2)
I believe there is a windows port of evince, which is rather nice.
I usually use okular on linux, though. Something about it I like better, but don't recall what right now.
How is this a real solution? (Score:2)
I highly doubt home consumers (i.e. your grandmother) are going to install this enterprise application in order to solve a "0 day" exploit for Adobe. I mean, really? Can a normal person even read the previous sentence I just wrote?
Maybe they should work harder at patching it then finding workarounds, or just tell us the truth (don't open any PDFs, or use foxit).
Re: (Score:2)
How would you suggest they patch it and get the patch out to users?
In my experience:
Of course, t
Re: (Score:2)
Fuck it, maybe *Adobe* could ship a lightweight PDF reader that strips out all "executable" PDF functionality (javascript, launching executables, embedding flash).
At this point, Adobe Reader is so stupidly bloated that I'll frankly be disappointed if Reader 10 doesn't launch a virtualised instance of Windows inside which another copy of Reader is used to actually render the PDF.
Re: (Score:1)
Worse are the "Adobe Dialogues" in their design software.
What a waste, the OS dialogue does a great job of letting me save to a network share, the Adobe one is slow and sucks.
It is complete wasted effort that appears to go solely into making the application less usable.
Re:Publicity is publicity (Score:4, Interesting)
Every time a news article says there's a flaw in Acrobat Reader and that everyone is vulnerable, it reinforces the idea that everyone uses Acrobat and there is no other option.
No such thing as bad publicity, bandwagon propaganda, and all that. They might as well put flaws in on purpose for the free monthly advertising. All it takes is a tiny portion of flaws to appear in Foxit, which does happen sometimes, and Adobe gets to claim that no reader is flaw-free.
Re: (Score:3, Informative)
You know, Foxit does this. It enables 'secure reading mode' when you open a PDF from the browser. Adobe should copy this feature, but instead they keep talking about a complex sandboxing scheme for their app.
I'd rather they put in a mode like this, but they won't. Why? Because all those features it disables have been engineered by Adobe and as such they have performed a defacto extension of the PDF spec. Disabling this feature is admission that Adobe is incompetent and that people can live without js/flas
Re: (Score:1)
Re: (Score:2)
You mean Evince. Personally, I prefer zathura [pwmt.org] - it's nice for those like me, who like programs that comply with the KISS principle and have a keyboard driven UI.
Re: (Score:2)
I like the document reader that comes with Gnome/Ubuntu.
Yeah, its getting better everytime. The other day I opened a pdf used for service inscription, I was amazed to see that evince displayed embedded form widgets like input boxes, dropdown menus etc.. It was slick!
TBH I prefer to be lagging in functionality and have security than the other way around - but that is just me!
EMET (Score:1)
Raises the question... (Score:1)
ASLR (Score:5, Informative)
According to the article..
"Normally Address Space Layout Randomization (ASLR) would help prevent successful exploitation. However, this product ships with a DLL (icucnv36.dll) that doesn’t have ASLR turned on."
So enable ASLR on the effing DLL and release a patch, problem solved? Nothing would make me work overtime and on the weekend than a highly visible level 1 bug. Adobe developers must have it good!
Address Space Layout Randomization... (Score:1, Interesting)
...was called Scatter Loading in AmigaOS 1.0 back in the 80's, and was done to everything loaded into RAM, executables, shared libraries, data, everything. *sigh*
Re: (Score:2)
Much though I wish this was a complete solution, there are two possible problems with it.
The first is that ASLR is only available on NT 6.x (Vista, 7, Server 2008). People using XP are out in the cold, which they arguably deserve for using such an outdated OS, but the rest of us don't deserve the collateral damage their rooted boxes will spew (for bonus points, XP has no form of browser sandboxing and the default user has Administrative permissions, making it the most likely to be successfully exploited in
Leave it to Microsoft (Score:2)
Just what the world needs: a security automaton [wikipedia.org] which drops dead if you get one letter wrong.
EMET Video (Score:1)
Mitigation, not Migration (Score:2)
It's the Enhanced Mitigation Experience Toolkit -- no migration required.
Re: (Score:2)
Yeah, that word threw me for a bit. On one hand, I was scared because I didn't want to know what Microsoft wanted to Migrate users to... on the other hand, it could have been a Windows to Linux migration tool... okay, probably not that but I have to pull some optimism from somewhere.
A different tactic is needed to protect Windows XP (Score:1)
icucnv36.dll (Score:2)
It is time for Adobe to cut down Acrobat features (Score:1)
Re: (Score:2)
Enhanced Mitigation Experience Toolkit (Score:1)
Subject (Score:2)
"'The good news is that if you have EMET enabled ... it blocks this exploit,'"
You know what else blocks this exploit? Not using Acrobat Reader.