Adobe Reader flaws spook security experts

According to their research, the trouble is in how Adobe tells the browser to handle .pdf files, and Firefox and Internet Explorer are particularly vulnerable.

The flaws affect Adobe Reader 6.0.1 for Windows via Internet Explorer 6 and version 7.0.8 for Windows via Firefox 2.0.0.1. Other versions may also be affected, warned Danish vulnerability clearinghouse Secunia. Di Paola said Adobe fixed the security holes in version 8.0.0, though experts worry that many users will be slow to upgrade, leaving themselves open to an easy attack.

According to the Symantec Corp. blog, the flaws are significant for a number of reasons:

• The ease in which they can be exploited is "breathtaking." Use of the feature in question requires no exploitation of vulnerabilities on the server side.
• Any Web site that hosts a .pdf file can be used to conduct an attack. "All the attacker has to do is find out who is hosting a .pdf file on their Web server and then piggy back on it to mount an attack," the Cupertino, Calif.-based vendor said. "What this means, in a nutshell, is that anybody hosting a .pdf file, including well-trusted brands and names on the Web, could have their trust abused and become unwilling partners in crime."
• Due to the power and flexibility of JavaScript, the attacker has a wide scope for inflicting damage.

Initially, Symantec reported that the problem appeared limited to Firefox, but that additional testing showed that systems running Internet Explorer 6 and Acrobat 7 on Windows XP SP1; and systems with Internet Explorer 6 and Acrobat 4 on Windows XP SP2 are also vulnerable to attack.

About Security Blog Log: Senior News Writer Bill Brenner peruses security blogs each day to see what's got the information security community buzzing. In this column he lists the weekly highlights. If you'd like to comment on the column or bring new security blogs to his attention, contact him at [email protected]. Recent columns: Skype Trojan: Much ado about nothing? Schneier: UCLA breach barely newsworthy Zero-Day Tracker a hit, but IT shops need better strategy

An assessment in the NIST.org blog is equally sobering.

"Let's get straight to the point: This vulnerability should not be taken lightly," the blog said. "If you have the Adobe Acrobat Reader browser plug-in installed, nearly any Web site that contains a .pdf file can now be exploited for cross-site scripting [attacks]."

If, for example, "yourlocalbank.com" hosts a .pdf file and the user has the Acrobat Reader browser plug-in installed and they click on a specially crafted link to the yourlocalbank.com .pdf file, "someone can steal your log-in credentials and take care of your online banking for you," NIST.org said. "Or the bad guy can create fake pages for phishing attacks that appear to be from legitimate sites and collect credit card information that way."

So what's an Adobe Reader user to do?

Stefan Esser suggested in the PHP Security blog that everyone disable the Adobe Acrobat .pdf plug-in in their browser.

Harry Waldron, a self-described Microsoft professional, suggested in his Microsoft MVP blog that users turn off Javascript.

But the best solution, according to organizations like Secunia and The French Security Incident Response Team (FrSIRT), is for users to wake up to the threat and upgrade to Adobe 8.0.0.