Adobe acknowledges PDF vulnerability, issues workaround

A week after Belgium-based security researcher Didier Stevens released a proof of concept exploit demonstrating a vulnerability in Adobe Reader, the company has acknowledged the vulnerability and offered users a workaround.

In a March 29 blog post, Stevens said that his hack, using the PDF specification's "/Launch" function, could exploit an up-to-date copy of Adobe Reader to enable the launching of scripts or .exe files embedded in PDF files. The vulnerability could also be exploited to spread PDF worms.

Usually, a warning message is presented when an executable within a PDF is about to be launched. But Stevens found a way to partially control the message displayed by this dialog box so that users were duped into clicking through. Computer users relying on Foxit Reader, another PDF reader application, received no warning message at all while the executable was launched without their knowledge.

Adobe has acknowledged Stevens' exploit and announced it is currently looking into a fix, which it could issue as part of its regularly scheduled quarterly product updates.

Meanwhile, the company is advising computer users to change a default setting under Edit/Preferences/Trust Manager to deactivate the "Allow opening of non-PDF file attachments with external applications" option. This box is checked by default in Reader and Acrobat, opening systems up to the socially engineered attack that Stevens exploited.

The company statement said: "After disabling this option, the demo exploit is no longer able to launch a command line when opened in Adobe Reader. Adobe Acrobat is also affected by the problem and can also be protected by deactivating this option."

The company also issued a fix for administrators wishing to alter registry setting on Windows to prevent the exploit, as well as the option to grey out the preference to keep end-users from turning the capability on.

Adobe is expected to release its patch plans for Reader and Acrobat today.

See original article on scmagazineus.com