Unpatched Adobe Reader users in jeopardy

Alexander Turcic · 01-06-2007, 05:51 PM

Stefano Di Paola and Giorgio Fedon uncovered a serious cross-site scripting vulnerability that affects unpatched versions of the Adobe Reader plug-in which is used to view PDF files from within Web browsers. The vulnerability could allow an attacker to run malicious Javascript code on compromised systems. Security researchers advise us to update Adobe to at least V7.0.9 or V8.0.

Alternatively, you can disable the Adobe Reader browser plug-in (in Firefox within the Settings / Content / Filetypes menu). Or alternatively, use Foxit Reader instead.

Original paper discussing the vulnerability: link (PDF!)
Technical explanation of the vulnerability: link

[via CNet]

Laurens · 01-07-2007, 04:54 AM

Adobe Reader will only update to 7.0.8 and I don't want to upgrade to 8.0. It's about time I checked out Foxit.

Moonraker · 01-07-2007, 08:20 AM

I use Foxit. It's less bloated and faster. Also, safer it seems!

derekweb · 01-08-2007, 10:31 AM

Does this also affect the downloaded PDFs as well? I use the Firefox plugin PDFDownLoad and love it. I HATE reading PDFs in Firefox, ... tends to cause it to crash, and seems to suck memory down like a hog! Even in FF2.0.

Oh well.

Alexander Turcic · 01-08-2007, 10:35 AM

Quote:

Originally Posted by derekweb

Does this also affect the downloaded PDFs as well? I use the Firefox plugin PDFDownLoad and love it. I HATE reading PDFs in Firefox, ... tends to cause it to crash, and seems to suck memory down like a hog! Even in FF2.0.

Oh well.

No, it only affects the Viewer plugin if you click on a special PDF download link prepared by the hacker that inserts the Javascript code.

Alexander Turcic · 01-11-2007, 05:00 AM

Quote:

Originally Posted by Laurens

Adobe Reader will only update to 7.0.8 and I don't want to upgrade to 8.0. It's about time I checked out Foxit.

7.0.9 is out since Tuesday... alas a full installation is required as a patch is not available.

01-06-2007, 05:51 PM	#1
Alexander Turcic Fully Converged Posts: 18,163 Karma: 14021202 Join Date: Oct 2002 Location: Switzerland Device: Too many to count here.	Unpatched Adobe Reader users in jeopardy Stefano Di Paola and Giorgio Fedon uncovered a serious cross-site scripting vulnerability that affects unpatched versions of the Adobe Reader plug-in which is used to view PDF files from within Web browsers. The vulnerability could allow an attacker to run malicious Javascript code on compromised systems. Security researchers advise us to update Adobe to at least V7.0.9 or V8.0. Alternatively, you can disable the Adobe Reader browser plug-in (in Firefox within the Settings / Content / Filetypes menu). Or alternatively, use Foxit Reader instead. Original paper discussing the vulnerability: link (PDF!) Technical explanation of the vulnerability: link [via CNet]

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Calibre with an unpatched PRS 505	aragon127	Calibre	4	08-30-2010 09:46 AM
Mac Users, how do you eject your Reader?	xtine	Sony Reader	18	12-21-2009 04:55 AM
Reader on Jeopardy! last night	MidknytOwl	Sony Reader	1	08-21-2008 04:14 PM
The Sony Reader made an appearance on Jeopardy! tonight.	TheLongshot	Sony Reader	10	02-20-2008 12:01 PM
iriver e-book reader powered by Adobe Reader LE, more photos	Alexander Turcic	News	14	06-13-2007 01:23 AM

01-07-2007, 04:54 AM	#2
Laurens Jah Blessed Posts: 1,295 Karma: 1373 Join Date: Apr 2003 Location: The Netherlands Device: iPod Touch	Adobe Reader will only update to 7.0.8 and I don't want to upgrade to 8.0. It's about time I checked out Foxit.

01-07-2007, 08:20 AM	#3
Moonraker Addict Posts: 314 Karma: 1002965 Join Date: Mar 2006 Location: UK Device: ILiad. Gen 3, PocketBook 360, Kobo Aura HD, Kindle Oasis 2	I use Foxit. It's less bloated and faster. Also, safer it seems!

01-08-2007, 10:31 AM	#4
derekweb Groupie Posts: 160 Karma: 3134 Join Date: Jun 2004 Location: United States Device: Palm Treo 700p & iPaq hx2755	Does this also affect the downloaded PDFs as well? I use the Firefox plugin PDFDownLoad and love it. I HATE reading PDFs in Firefox, ... tends to cause it to crash, and seems to suck memory down like a hog! Even in FF2.0. Oh well.

Advert

Advert