Google warns of using Adobe Reader - particularly on Linux

By +Frank B.
in Back Page News

 Share

Recommended Posts

Grand Master

+Frank B. Subscriber²

Posted
  • Subscriber²
Posted

Google warns of using Adobe Reader - particularly on Linux

On its August Patch Day, Adobe has fixed numerous critical memory-related bugs in Reader for Windows and Mac OS X ? but has chosen to overlook Linux users. The researchers who discovered the holes now fear that potential attackers could find enough clues to build an exploit by comparing the current Windows version of Reader with the previous one. This would leave Linux users defenceless. On top of that, even the patched versions still contain a total of 16 open security holes.

Google employees Mateusz Jurczyk and Gynvael Coldwind initially examined the PDF engine of the Chrome browser and discovered numerous holes. They then tested Adobe Reader and found about 60 issues that triggered crashes, 40 of which are potential attack vectors. When the two researchers reported their discoveries to Adobe, the company promised to provide fixes ? but also indicated that not all the holes would be closed on Patch Day in August.

On Tuesday, that is exactly what happened. Versions 10.1.4 and 9.5.2 were released for Windows and Mac OS X only. Even these patched versions are still vulnerable to 16 of the reported issues that affect Windows, Mac OS X or both systems. To prove this, the Google employees have released obfuscated information concerning the crashes. The security experts say that the unpatched holes could potentially be identified by third parties because they were found by modifying publicly available PDF documents.

Apparently, the researchers' threat to publish all vulnerability details online in accordance with "responsible disclosure" did not worry Adobe. The deadline is set for 60 days after the day on which the researchers informed Adobe about the holes: 27 August. However, Adobe told the researchers that no further updates are planned in that timeframe.

The Google employees therefore recommend that users refrain from opening any PDF documents from external sources in Adobe Reader. Those who use a browser other than Chrome can protect themselves by disabling the Reader's browser extension. The extension allows the holes to be exploited with a simple visit to a specially crafted web page.

Windows users who still use version 9 of Reader have been advised to upgrade to Adobe Reader X, because this version contains a sandbox that makes exploiting the holes more difficult. While Linux users can fix two of the holes by deleting the annots.api and PPKLite.api plug-ins from the /path/to/Adobe/Reader9/Reader/intellinux/plug_ins directory, this seems like a drop in the ocean when considering the total number of holes that riddle Reader for Linux.

Source: The H Online

Veteran

The Dark Knight

Posted
Posted

I stopped using that bug ridden bloatware on all platforms a long time ago.

What do you use instead? I am also looking for a good replacement.

Grand Master

Noir Angel

Posted
Posted

I use Foxit on Windows, haven't used Adobe reader for about 3 years. It's bloated, slow, and now apparently insecure. And I didn't know the PDF plugin in Chrome was made by Adobe, how do I disable it?

This topic is now closed to further replies.
 Share
Go to topic listing

  • Posts

    • Epic Games says Unreal Engine 6 will help developers "build content faster" using AI models

      By +pmrd · Posted

      Which game runs at 20fps with framegen?
    • Epic Games says Unreal Engine 6 will help developers "build content faster" using AI models

      By +pmrd · Posted

      The problem isn't with Epic, it's with the platform holders like Steam and Nintendo, they should be a lot more strict in their review process.
    • Nvidia 610.62 driver lands with big bug fixes and Empulse support

      By goretsky · Posted

      Hello, Installed here without issue. Regards, Aryeh Goretsky
    • Microsoft updates Visual Studio Code with easier language model discovery and in-app search

      By zikalify · Posted

      Microsoft updates Visual Studio Code with easier language model discovery and in-app search by Paul Hill Microsoft has released Visual Studio Code 1.125, its latest weekly release. This week, the company has focused on discovering and installing extra language models via the Marketplace; searching the web and securely browsing over remote connections without leaving VS Code; choosing how long VS Code waits before installing extension updates; and delivering managed Copilot settings through existing device management tooling. In older versions of VS Code, extensions could contribute their own model providers, but to find these extensions, you needed the right tags to search for in the Extension view. Now, the Language Models editor gives you an Install Model Providers button that opens the Extensions view, which is filtered to extensions that contribute model providers, making it easier to find and install them. Once you install a provider, its model will appear in the model picker. If you use the integrated browser much, you can now look up information without leaving VS Code by typing a query into the integrated browser’s address bar. It will use your configured search engine, the same way a standalone browser does. You can use workbench.browser.searchEngine to pick a search engine. When the browser is opened in a remote workspace, it's now possible to proxy HTTP(S) traffic via the remote connection. This allows you to connect to any ports or services that can only be accessed from the remote machine. If you read our coverage from two weeks ago about VS Code 1.123, you might have seen that extension updates have a two-hour delay as a safety measure. In this update, Microsoft is giving you the ability to configure the time of the delay. You can find it under extensions.autoUpdateDelay. Finally, with this update, admins can deliver managed GitHub Copilot settings through native device management (MDM) channels on Windows and macOS, in addition to account-based enterprise settings files. Settings delivered via MDM appear as policy-enforced in VS Code and can’t be overridden locally. Future updates will extend the supported policy keys across Copilot surfaces. You can download the update from the Visual Studio Code website now.
    • Microsoft will finally let you sign in to Edge with a Google account

      By monterxz · Posted

      "it opens up new doors for people who prefer using Edge, but cannot be bothered to configure a Microsoft account" You already have a Microsoft account if you are using Windows 11, because you can't set it up without one.

  • Recent Achievements

    • Week One Done
      Classifyskilleducation earned a badge
      Week One Done
    • One Month Later
      eurospharma62 earned a badge
      One Month Later
    • Week One Done
      With What earned a badge
      Week One Done
    • Week One Done
      Harris Gilbert earned a badge
      Week One Done
    • One Month Later
      Vincian earned a badge
      One Month Later

  • Popular Contributors

    1. 1
      +primortal
      543
    2. 2
      +Edouard
      171
    3. 3
      PsYcHoKiLLa
      84
    4. 4
      ATLien_0
      64
    5. 5
      neufuse
      64
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!