Google warns of using Adobe Reader - particularly on Linux

By +Frank B.
in Back Page News

 Share

Recommended Posts

Grand Master

+Frank B. Subscriber²

Posted
  • Subscriber²
Posted

Google warns of using Adobe Reader - particularly on Linux

On its August Patch Day, Adobe has fixed numerous critical memory-related bugs in Reader for Windows and Mac OS X ? but has chosen to overlook Linux users. The researchers who discovered the holes now fear that potential attackers could find enough clues to build an exploit by comparing the current Windows version of Reader with the previous one. This would leave Linux users defenceless. On top of that, even the patched versions still contain a total of 16 open security holes.

Google employees Mateusz Jurczyk and Gynvael Coldwind initially examined the PDF engine of the Chrome browser and discovered numerous holes. They then tested Adobe Reader and found about 60 issues that triggered crashes, 40 of which are potential attack vectors. When the two researchers reported their discoveries to Adobe, the company promised to provide fixes ? but also indicated that not all the holes would be closed on Patch Day in August.

On Tuesday, that is exactly what happened. Versions 10.1.4 and 9.5.2 were released for Windows and Mac OS X only. Even these patched versions are still vulnerable to 16 of the reported issues that affect Windows, Mac OS X or both systems. To prove this, the Google employees have released obfuscated information concerning the crashes. The security experts say that the unpatched holes could potentially be identified by third parties because they were found by modifying publicly available PDF documents.

Apparently, the researchers' threat to publish all vulnerability details online in accordance with "responsible disclosure" did not worry Adobe. The deadline is set for 60 days after the day on which the researchers informed Adobe about the holes: 27 August. However, Adobe told the researchers that no further updates are planned in that timeframe.

The Google employees therefore recommend that users refrain from opening any PDF documents from external sources in Adobe Reader. Those who use a browser other than Chrome can protect themselves by disabling the Reader's browser extension. The extension allows the holes to be exploited with a simple visit to a specially crafted web page.

Windows users who still use version 9 of Reader have been advised to upgrade to Adobe Reader X, because this version contains a sandbox that makes exploiting the holes more difficult. While Linux users can fix two of the holes by deleting the annots.api and PPKLite.api plug-ins from the /path/to/Adobe/Reader9/Reader/intellinux/plug_ins directory, this seems like a drop in the ocean when considering the total number of holes that riddle Reader for Linux.

Source: The H Online

Veteran

The Dark Knight

Posted
Posted

I stopped using that bug ridden bloatware on all platforms a long time ago.

What do you use instead? I am also looking for a good replacement.

Grand Master

Noir Angel

Posted
Posted

I use Foxit on Windows, haven't used Adobe reader for about 3 years. It's bloated, slow, and now apparently insecure. And I didn't know the PDF plugin in Chrome was made by Adobe, how do I disable it?

This topic is now closed to further replies.
 Share
Go to topic listing

  • Posts

    • Apple CEO Tim Cook confirms looming price hikes due to memory shortages

      By Hamid Ganji · Posted

      Apple CEO Tim Cook confirms looming price hikes due to memory shortages by Hamid Ganji Image via Apple Memory and chip shortages have led to significant price increases for electronics over the past year, and it seems that more hikes are on the way for upcoming smartphones and computers. Apple CEO Tim Cook has confirmed that the company is planning to increase the prices of some of its products due to the ongoing memory and storage shortages. In an interview with The Wall Street Journal, Cook confirmed the looming price hikes for Apple’s future products, adding that “Unfortunately, price increases are unavoidable.” He also said the company is doing its best to “mitigate the huge increases that are being passed to us, and we’ve been trying to shield our customers from the increases, but the situation has become unsustainable.” The Apple CEO also noted that the allocation of a large portion of memory chips to AI companies has contributed to shortages in the market, resulting in lower supply at a time when demand for devices remains high. “We definitely need memory pricing and supply to return to reasonable levels for consumer products. That’s the bottom line,” Cook said. Cook also added that Apple is ready to use its vast cash reserves to help boost supply in the market because additional production capacity is needed. While he declined to specify how Apple plans to do that, he said the company will not build its own memory and storage factories despite its financial resources and silicon expertise. Cook did not provide further details on the scale of the price increases or which Apple products would be affected, though iPads and Macs could see higher prices sooner than other products. Apple’s next product launch event is scheduled for September, when the company is expected to unveil the iPhone 18 Pro, iPhone 18 Pro Max, and its first foldable iPhone. It remains unclear whether the upcoming iPhones will be affected by the price increases, but given the current memory shortage, higher prices seem increasingly likely. There is currently no clear timeline for the end of the memory shortage. Samsung, one of the world’s three largest memory chip manufacturers, recently said the shortage could persist for several more years.
    • Samsung is shutting down yet another app used by millions

      By AgusL · Posted

      Downloads does not equal actual usage, even less when the app is pre-installed in some Galaxy phones.
    • Mozilla highlights Firefox Nova 2026 redesign and more upcoming features with new roadmap

      By AgusL · Posted

      +1000 to this, don't understand why they added that margin around the top bar, even the close button is a PITA to click without aiming. Ofc, this is just preview and hopefully they will revert such odd UX decision before hitting final version.
    • Rockstar gives last-gen GTA V players free upgrades tomorrow

      By THE END · Posted

      so the people who bought this will get a refund?
    • Nearly half of American adults now use AI, but concerns are also growing

      By Jose_49 · Posted

  • Recent Achievements

    • One Month Later
      eurospharma62 earned a badge
      One Month Later
    • Week One Done
      With What earned a badge
      Week One Done
    • Week One Done
      Harris Gilbert earned a badge
      Week One Done
    • One Month Later
      Vincian earned a badge
      One Month Later
    • First Post
      Jocimo earned a badge
      First Post

  • Popular Contributors

    1. 1
      +primortal
      542
    2. 2
      +Edouard
      167
    3. 3
      PsYcHoKiLLa
      86
    4. 4
      Steven P.
      64
    5. 5
      ATLien_0
      64
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!