Google warns of using Adobe Reader - particularly on Linux

By +Frank B.
in Back Page News

 Share

Recommended Posts

Grand Master

+Frank B. Subscriber²

Posted
  • Subscriber²
Posted

Google warns of using Adobe Reader - particularly on Linux

On its August Patch Day, Adobe has fixed numerous critical memory-related bugs in Reader for Windows and Mac OS X ? but has chosen to overlook Linux users. The researchers who discovered the holes now fear that potential attackers could find enough clues to build an exploit by comparing the current Windows version of Reader with the previous one. This would leave Linux users defenceless. On top of that, even the patched versions still contain a total of 16 open security holes.

Google employees Mateusz Jurczyk and Gynvael Coldwind initially examined the PDF engine of the Chrome browser and discovered numerous holes. They then tested Adobe Reader and found about 60 issues that triggered crashes, 40 of which are potential attack vectors. When the two researchers reported their discoveries to Adobe, the company promised to provide fixes ? but also indicated that not all the holes would be closed on Patch Day in August.

On Tuesday, that is exactly what happened. Versions 10.1.4 and 9.5.2 were released for Windows and Mac OS X only. Even these patched versions are still vulnerable to 16 of the reported issues that affect Windows, Mac OS X or both systems. To prove this, the Google employees have released obfuscated information concerning the crashes. The security experts say that the unpatched holes could potentially be identified by third parties because they were found by modifying publicly available PDF documents.

Apparently, the researchers' threat to publish all vulnerability details online in accordance with "responsible disclosure" did not worry Adobe. The deadline is set for 60 days after the day on which the researchers informed Adobe about the holes: 27 August. However, Adobe told the researchers that no further updates are planned in that timeframe.

The Google employees therefore recommend that users refrain from opening any PDF documents from external sources in Adobe Reader. Those who use a browser other than Chrome can protect themselves by disabling the Reader's browser extension. The extension allows the holes to be exploited with a simple visit to a specially crafted web page.

Windows users who still use version 9 of Reader have been advised to upgrade to Adobe Reader X, because this version contains a sandbox that makes exploiting the holes more difficult. While Linux users can fix two of the holes by deleting the annots.api and PPKLite.api plug-ins from the /path/to/Adobe/Reader9/Reader/intellinux/plug_ins directory, this seems like a drop in the ocean when considering the total number of holes that riddle Reader for Linux.

Source: The H Online

Veteran

The Dark Knight

Posted
Posted

I stopped using that bug ridden bloatware on all platforms a long time ago.

What do you use instead? I am also looking for a good replacement.

Grand Master

Noir Angel

Posted
Posted

I use Foxit on Windows, haven't used Adobe reader for about 3 years. It's bloated, slow, and now apparently insecure. And I didn't know the PDF plugin in Chrome was made by Adobe, how do I disable it?

This topic is now closed to further replies.
 Share
Go to topic listing

  • Posts

    • WhatsApp slams Isreali firm, NSO Group, for trying to spy on its users

      By Lamp Post · Posted

      Pure racism.
    • Google Chrome is killing all uBlock Origin bypasses, Microsoft Edge, Opera to follow

      By Nas · Posted

      FWIW StatCounter has been trash for over 25+ years! Back in the day (circa 2000 and GeoCities pre-Blogger era), it was useful to paste a number on your webpage indicating how many visitors you had. In the ensuing 25+ years, they've grown in reputation and changed their ways... but their overall consumer value has remained abysmal. Serious marketing agencies only cite StatCounter when there's literally no other sources available to support any marketing claims! They are the absolute lowest threshold serious companies use to push any sort of narrative about this-or-that happening. Besides their credibility being what it is, they are forever subject to quality issues. They're so bad that my DNS-level ad-filter prevents me from even viewing their main website! HA!
    • Microsoft had to shut down 70+ GitHub repos after getting hacked, brings back some

      By Aditya Tiwari · Posted

      Microsoft had to shut down 70+ GitHub repos after getting hacked, brings back some by Aditya Tiwari The self-replicating malware campaign known as Miasma took the open-source world by storm. It was reported that almost 73 Microsoft GitHub repositories were infected by the worm and had to be temporarily shut down to determine how attackers compromised projects and stuffed password-stealing malware in the code. These GitHub repos span across different organizations, including Microsoft Azure, Azure-Samples, Microsoft, and MicrosoftDocs. The malware enabled attackers to steal passwords and credentials when compromised tools were opened in popular AI coding apps, including Claude Code, Gemini CLI, VS Code, and Cursor. The security firm Cloudsmith, malware analysis site OpenSourceMalware, and 404 Media were among the first to report the hack. For background, Miasma is a variant of the Mini Shai-Hulud worm, open-sourced by the threat group TeamPCP. It started its journey by compromising a Red Hat employee's GitHub account to attack the @redhat-cloud-services npm namespace. Earlier this month, Microsoft Threat Intelligence reported that the Miasma attackers published 32 malicious packages across more than 90 versions under the @redhat-cloud-services npm scope to steal cloud credentials. The worm didn't take long to start attacking source repos directly rather than package registries. It is known to skip the npm registry entirely for several targets and plant malicious code straight into public repos like "icflorescu/mantine-datatable." The delivery approach was designed to weaponize AI coding tools. Miasma's malicious payload embedded into projects can trigger automatic code execution when the infected repo is opened in an AI coding tool or IDE. The list of affected projects includes "durabletask", a Python package compromised by TeamPCP a month earlier to deliver an information stealer designed for Linux systems. That said, Microsoft has begun restoring some repos affected by the malware campaign, The Hacker News reports. A company spokesperson stated the following: Microsoft will continue to investigate the attack. It has notified a small number of customers who may have removed their content from the affected repos. The company will reach out to customers again through established support channels "if anything further is identified that requires customer action."
    • Google Chrome is killing all uBlock Origin bypasses, Microsoft Edge, Opera to follow

      By RejZoR · Posted

      Why is Opera doing this notification at all? They have their own extension store. They don't have to obey anything dictated by Google. Others like Brave and Vivaldi that rely on Chrome's extension store, not so much. Firefox is entirely separate as well with its own extensions store. I honestly don't understand why entire world is just insisting on Chrome. Like, why? It's a stupid fat browser with barely any functionality. But sure, it's installed on everything by default. I don't understand how people even use web that's filled with tracking garbage and ads all over the place.
    • Politically funny images of the World

      By Steven P. · Posted

  • Recent Achievements

    • Week One Done
      rubentuben8 earned a badge
      Week One Done
    • Week One Done
      ARaclen earned a badge
      Week One Done
    • One Year In
      jojodbn earned a badge
      One Year In
    • One Month Later
      jojodbn earned a badge
      One Month Later
    • Week One Done
      jojodbn earned a badge
      Week One Done

  • Popular Contributors

    1. 1
      +primortal
      529
    2. 2
      PsYcHoKiLLa
      231
    3. 3
      +Edouard
      131
    4. 4
      ATLien_0
      88
    5. 5
      Steven P.
      82
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!