Researchers Stefano Di Paola and Giorgio Fedon have created quite a
stir in the blogosphere this week over some easily-exploitable
flaws they reported in Adobe Reader, a .pdf viewer used by just
about everyone. According to various security experts, digital
miscreants could exploit the vulnerabilities to launch cross-site
scripting attacks and do a variety of damage.
According to their
research, the trouble is in how Adobe tells the
browser to handle .pdf files, and Firefox and Internet Explorer are
particularly vulnerable.
The flaws affect Adobe Reader 6.0.1 for Windows via Internet
Explorer 6 and version 7.0.8 for Windows via Firefox 2.0.0.1. Other
versions may also be affected, warned Danish vulnerability
clearinghouse Secunia. Di Paola said Adobe fixed the security holes
in version 8.0.0, though experts worry that many users will be slow
to upgrade, leaving themselves open to an easy attack.
According to the
Symantec Corp. blog, the flaws are
significant for a number of reasons:
- The ease in which they can be exploited is "breathtaking." Use
of the feature in question requires no exploitation of
vulnerabilities on the server side.
- Any Web site that hosts a .pdf file can be used to conduct an
attack. "All the attacker has to do is find out who is hosting a
.pdf file on their Web server and then piggy back on it to mount an
attack," the Cupertino, Calif.-based vendor said. "What this means,
in a nutshell, is that anybody hosting a .pdf file, including
well-trusted brands and names on the Web, could have their trust
abused and become unwilling partners in crime."
- Due to the power and flexibility of JavaScript, the attacker
has a wide scope for inflicting damage.
Initially, Symantec reported that the problem appeared limited
to Firefox, but that additional testing showed that systems running
Internet Explorer 6 and Acrobat 7 on Windows XP SP1; and systems
with Internet Explorer 6 and Acrobat 4 on Windows XP SP2 are also
vulnerable to attack.
An assessment in the
NIST.org blog is equally sobering.
"Let's get straight to the point: This vulnerability should not
be taken lightly," the blog said. "If you have the Adobe Acrobat
Reader browser plug-in installed, nearly any Web site that contains
a .pdf file can now be exploited for cross-site scripting
[attacks]."
If, for example, "yourlocalbank.com" hosts a .pdf file and the
user has the Acrobat Reader browser plug-in installed and they
click on a specially crafted link to the yourlocalbank.com .pdf
file, "someone can steal your log-in credentials and take care of
your online banking for you," NIST.org said. "Or the bad guy can
create fake pages for phishing attacks that appear to be from
legitimate sites and collect credit card information that way."
So what's an Adobe Reader user to do?
Stefan Esser suggested in the
PHP Security blog that everyone disable the
Adobe Acrobat .pdf plug-in in their browser.
Harry Waldron, a self-described Microsoft professional,
suggested in his
Microsoft MVP blog that users turn off
Javascript.
But the best solution, according to organizations like Secunia
and The French Security Incident Response Team (FrSIRT), is for
users to wake up to the threat and upgrade to
Adobe 8.0.0.