PDF security hole opens can of worms The security perils of PDF files have been further highlighted by new research illustrating how a manipulated file might be used to infect other PDF files on a system. Jeremy Conway, an application security researcher at NitroSecurity, said the attack scenario he has discovered shows PDFs are "wormable". Computer viruses are …
Xpdf's change log does not mention javascript, and one of the design goals is to keep it simple. There is a good chance that Xpdf will remain safe for years/decades. The Gnome and KDE pdf viewers used to use Xpdf's backend library, so old versions of KPDF and GPDF are safe. New versions are switching / have switched to Poppler - a derivative of Xpdf. Poppler got javascript support late in 2009. It looks like animation support is in progress but not yet complete. (I am not sure how to print out an animation ;-).
For full virus support you may have to wait for the gnu pdf library and the viewer (Juggler) that uses it. When complete, Gnu PDF should be able to run portable malware, but so far many malware authors have not made the effort to write portable viruses. Perhaps one day, the open source community will be able to experience the full range of malware available to Windows users, but today, that is still a far off dream. Has anyone got any Microsoft malware that runs properly in WINE?
If you are looking for a new pdf reader, take your pick: http://www.pdfreaders.org/
This post has been deleted by its author
Yes and no.
Yes, the PDF specification still requires these things to be present.
No, most malicious PDFs will be loaded with malware designed to attack Windows, not *nix machines. Additionally, even if one did aim for *nix machine, who uses an admin account on a *nix machine to open PDF files anyways? The damage will be far more limited.
Free software doesn't usually implement the entire specification. If the spec requires something stupid the implementer usually just ignores that bit of it. They're trying to make a useful program, not gain certification. Xpdf is probably safer than Adobe's Acrobat software.
It doesn't matter whether you use an "admin" account if the alternative is using the same account that you do everything else with. If your main user account is compromised then so is all the data you care about and if the attacker needed root they could get it by replacing the su or sudo command, for example. However, if the attacker just wants to send spam they can do that from any account. To put it another way: who uses a special "nobody" account to open PDF files? Only a few very careful people, I would guess.
"su and sudo may be world executable but they are only writable by root so they can't be replaced."
What he means is for the malware to execute the command ''sudo something evil'', ie use ''sudo'' in the executed command not ''su''. This may work because sudo can be configured to remember that someone authenticated recently and so not ask for a password.
As long as you are not using the official Adobe reader it looks like you will be safe in Linux.
You would have to be a complete moron to be running the official Adobe reader in the first place seeing as there are far better alternatives (I find the default reader in kde4 and gnome so much quicker and less memory hungry than the official reader ...)
From http://news.cnet.com/8301-27080_3-20001792-245.html:
Update April 6 9:15 a.m. PDT: An Adobe spokeswoman replied Monday night with the same statement above and this: "Users can also turn off this functionality in the Adobe Reader and Adobe Acrobat Preferences by selecting > Edit > Preferences > Categories > Trust Manager > PDF File Attachments and clearing the box 'Allow opening of non-PDF file attachments with external applications.'"
If adobe didn't stuff the PDF file format with embedded crap like video we would not have this crap. But then no one would need to spend $150 on an upgrade every year if they didn't keep putting more and more crap into the format (I'm still using V6, nothing in v9 I want).
PDF should just be an electronic version of what you would put on a piece of paper. It should not be an interactive, multimedia, dog and pony show. If I wanted to do that I'd email my invoice to customers in Flash format :P
Somewhere back in the mists of time, PDF was simple. Acrobat Reader was simple and small. They did exactly what was necessary to provide a portable document ideally suited to on-screen viewing, printing out and *nothing* *more*.
Then, as usual with these things, the software company responsible had to go ruin it with needless "convenience" features and fancy stuff nobody really needs (Javascript? Embedded executables? How is it a portable document if it's got an OS-specific EXE buried in there anyway? WTF??), and in the process left it full of security holes, not to mention turning a simple document reader program into a full-fledged example of bloat gone wild (a 38MB download for version 9? Really? Their heads have come undone if they think that's acceptable).
You would *think* that someone would have figured this out after the raft of viruses targeted at Word and Excel files, but apparently not.
Do you just cut and paste from the last PDF vulnerability article (usually less than two weeks ago) or do you have a template set up specifically for PDF and flash flaws. Adobe has the worst software security wise and it really is a huge economic sink hole that few realize. I suppose outsourcing everything to India a while back didn't work so well as shown by held together by duct tape, gum and chicken wire software. You get what you pay for unless you actually buy anything from Adobe in which case you got screwed.
You open a PDF and a bunch of stuff you care about is screwed up, I'm not sure how this makes it a worm? I understood that worms spread w/o human interaction, say by exploiting a vunerability in a network service etc. This seems like trojan activity unless I'm missing something.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
