Adobe acknowledges PDF flaw, issues workaround
Updated on Friday, April 9 at 9:12 a.m. EST
A week after Belgium-based security researcher Didier Stevens released a proof-of-concept exploit demonstrating a vulnerability in Adobe Reader, the company has acknowledged the vulnerability and offered users a workaround.
In a March 29 blog post, Stevens said that his hack, using the PDF specification's "/Launch" function, could exploit an up-to-date copy of Adobe Reader to enable the launching of scripts or .exe files embedded in PDF files. The vulnerability could also be exploited to spread PDF worms.
Usually, a warning message is presented when an executable within a PDF is about to be launched. But Stevens found a way to partially control the message displayed by this dialog box so that users were duped into clicking through. Computer users relying on Foxit Reader, another PDF reader application, received no warning message at all while the executable was launched without their knowledge.
Adobe earlier this week acknowledged Stevens' exploit and announced it is currently looking into a fix, which it could issue as part of its regularly scheduled quarterly product updates.
Meanwhile, the company is advising computer users to change a default setting under Edit/Preferences/Trust Manager to deactivate the "Allow opening of non-PDF file attachments with external applications" option. This box is checked by default in Reader and Acrobat, opening systems up to the socially engineered attack that Stevens exploited.
The company statement said: "After disabling this option, the demo exploit is no longer able to launch a command line when opened in Adobe Reader. Adobe Acrobat is also affected by the problem and can also be protected by deactivating this option."
The company also issued a fix for administrators wishing to alter registry setting on Windows to prevent the exploit, as well as the option to gray out the preference to keep end-users from turning the capability on.
In a statement, Foxit, also maker of PDF readers, said it looked into the situation as well and released a new version of Foxit Reader with a fix on April 2.
"To address the specific problems outlined, Foxit has added a warning dialog box that will pop up when a PDF file is opened with Foxit Reader, asking the user to agree to execute or not," the company said. "This solution adds a layer of safety, yet maintains Foxit Reader's compliance with current PDF standards."
Meanwhile, Adobe is expected to release unrelated patches for its Reader and Acrobat software on Tuesday.
