Adobe loses security grip and falls to earth

Techworld.com ^ | December 15, 2004 | Techworld staff

[holymoly]

Acrobat and also Ethereal suffer vulnerability alerts.

Adobe has patched two bugs in its ubiquitous Acrobat Reader application that could allow an attacker to take over a user's system via a malicious pdf file attached to an e-mail message. The bugs affect Windows, Mac OS X and Unix.

Separately, developers warned of bugs in Ethereal, a popular network protocol analyser, that could allow an attacker to take over a system.

Security research company iDefense warned of the bug affecting Windows and Mac in an advisory published on the Bugtraq mailing list late on Tuesday. The problem is a format string vulnerability in version 6.0.2 of Adobe Reader, allowing users to craft a special .etd file that could cause an invalid memory access and allow for the execution of malicious code with the privileges of the user. Reader uses .etd files in handling eBooks.

The bug could be exploited by an e-mail containing either a malicious pdf file or a link to such a file, according to iDefense. The company said earlier versions of Reader 6 could be vulnerable, and said the bug is likely to also affect Adobe Acrobat, the application used to create pdf files.

Adobe released a fix in version 6.0.3 of both Acrobat and Acrobat Reader for Windows and Mac OS X. All the updates are available from Adobe's Web site.

iDefense said users could also work around the problem by deleting the file "C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\eBook.api", which makes Reader and Acrobat unable to handle eBooks.

A similar bug affects Unix. A boundary error in the "mailListIsPdf()" function, which checks to see whether a document in an email is a PDF file, unsafely copies user supplied data into a fixed sized buffer, according to iDefense.

This could allow an attacker to cause a buffer overflow and execute malicious code, the company said. Adobe has fixed the bug in Acrobat Reader version 5.0.9 for Unix, available on its site. iDefense said previous versions of Reader 5 are likely to also be affected. In its advisory, iDefense included a shell script patch users can apply for additional protection.

Ethereal bug

Several bugs were also reported in Ethereal, which claims to be one of the most popular tools for network software and protocol development, troubleshooting and analysis. The bugs can make the application hang, crash or otherwise disrupt a system, and may also allow allow for malicious code execution, Ethereal's developers said.

"It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire or by convincing someone to read a malformed packet trace file," the project said in a Wednesday advisory.

The bugs affect versions 0.9.0 up to and including 0.10.7, and are fixed in version 0.10.8. Secunia, which publishes an independent security database, said the problems were "highly critical".

[zeugma]

"I keep backups of most of this because this is the stuff that matters!"

Sorry, my mistake! Consider my reply more to the general population then. Most people don't do backups. I think one reason for this is because with windows, it is much harder to do in most cases than it is with Linux. When I want to be sure that I'm getting all my important data, all I have to do us make sure that I get /home/*. With windows, you're never really sure where all your data is, even if your fairly careful about such things. Also, most of the important configuration information can be found in /etc/* If I get those two directory structures, I'm pretty darn sure I've got everything that matters to me.

[general_re]

The only solution I can see is fine-grained access controls for all applications. If something claim to be a password management utility, it has no business even looking in my address book, let alone opening network connections, and the OS should enforce that.

Sounds great in theory - practice is likely to be a bit more slippery. So you download some helpful new password manager, and now we have three options to implement our fine-grained permissions:

1) We trust the program - and by extension, its author - to set appropriate permissions for itself, or;
2) We have the system try to guess at what appropriate permissions should be for "Whizzo 1.0", or;
3) We take a walk through our systems, trying to guess for ourselves what appropriate permissions should be for Whizzo, judging whether each file, library, directory, or device is something that Whizzo might legitimately need to touch someday. And you'll need to judge which other programs should legitimately be able to touch Whizzo.

And I have to say that #1 leaves you no better off than you are today, #2 doesn't sound do-able in any sort of reliable fashion, and #3 sounds like an incredible PITA. ;)

[Swordmaker]

Mac Security PING... problem with Adobe Acrobat Reader and PDF files.

As always, if you want to be added or deleted on the Mac Ping list, Freepmail me.

[SunkenCiv]

thanks.

[antiRepublicrat]

Adobe security sucks (and I mean that as nicely as possible since I have friends who work there). Acrobat, and many pathetic attempts to secure PDF files, have never had good security. My belief of the main reason is that it was designed from the beginning to be very open, and it's hard to secure something started on that basis (kind of like Windows).

[SunkenCiv]

Downloads page:
http://www.adobe.com/support/downloads/main.html

[LTCJ]

Linux ping. (Does not involve fava beans.)

[ShadowAce]

Security Ping (with no fava beans, as LTCJ mentioned)

[stylin_geek]

Actually, I think if you go to the Microsoft web site, you will find there is a known bug or exploit involving the jpeg format.

[NotJustAnotherPrettyFace]

Thanks for posting this article and helping to educate/inform us!

[Ernest_at_the_Beach]

You would then keep all your important stuff on a separate user account that you never connect to the internet with.

With all windows users running with administrator root priviledges, it likely will not help if the virus or trojan is smart enough.,......

[Ernest_at_the_Beach]

With the low cost of computers these days, maybe you should even set up a separate Internet browsing PC.

That is what I have done...... with a KVM 2X switch (Under 50$) you can share monitor, keyboard and mouse......

[Ernest_at_the_Beach]

But I have financial records, web design templates/graphics, reports I've written for graduate school, tons of programing/scripting examples I keep for reference, digital photos, etc.. I keep backups of most of this because this is the stuff that matters!

So why would you use such a precious asset in such a dangerous manner, (which browseing the internet is these days).....?

[avg_freeper]

So why would you use such a precious asset in such a dangerous manner, (which browseing the internet is these days).....?

That's what I'm saying. Create two accounts per user. One for important stuff the other for external access. Under no circumstances grant admin/superuser access to either account. The user could then operate within the safe account for document creation/use. The safe account would be restricted from almost all external access. Then fast-switch over to the unsafe account for any internet browsing/emailing.

In theory you could even have some kind of portal to transfer documents from the unsafe to the safe account.

For instance, I could attach a folder script to the safe account's OS X drop box making it perform a virus scan on any new documents. So let's say I want to process some file off the internet. I could fast/switch over to the unsafe account, download the file, and drop it into the safe accounts drop box. I then fast/switch back to the safe account and the drop box folder starts virus checking the new file it's detected.

I know my idea is a convoluted mess but maybe it's come to that for users that are incapable of practicing necessary discretion.

[Ernest_at_the_Beach]

You're not running Windows?

[avg_freeper]

You're not running Windows?

I've used and own various operating systems. I use my 500MhzDP Mac G4 most of the time. Even though with OS X it's gotten snail pace slow.

I do know that both macs and windows computers now allow fast user switching. i.e. with a click of a button (along with UID/password) you can instantly login as a different user. The system saves the state of the previous user's environment at the switch. No saving documents and shutting down apps needed.

So in theory, this dual account system would work for PCs and Macs.

[ThinkDifferent]

Sounds great in theory - practice is likely to be a bit more slippery

Absolutely, if it were easy we'd have it by now. But I wouldn't be surprised if Microsoft at least makes an attempt to do something like this in the near future, given the increasing malware problems.

[Bush2000]

Uh, you do back up your data don't you? If not you're waiting to get nailed. It could be something malicious, or a power outage, but you'll buy the farm (computationally speaking) eventually.

It's not just the threat of deleted/corrupted data that's at stake here. The ability to run arbitrary code means that an attacker can quietly shell out and run an app (ie. sendmail, ftp) that will sendyour private data, for example, to some non-extradition treaty country. The location of the tools on your box is well known. So is the data. ~/. And an attacker doesn't have to be too discriminating about which data to send. With broadband connections, he/she can send it ALL. So people shouldn't shrug off user-mode attacks; in a lot of ways, they can be even more devastating.

[Bush2000]

Nobody claims Linux and Macs are impenetrable, except the strawmen in the minds of Windows advocates.

Uh, no, TD. Everyone here has witnessed the countless diatribes of Mac and Linux bigots, railing against Windows and/or Microsoft -- pleading with people to 'just switch...' -- while insisting that 'their platform isn't vulnerable to viruses, worms, and malware.

It amounts to the same thing.

[ThinkDifferent]

while insisting that 'their platform isn't vulnerable to viruses, worms, and malware

You left out an "as" in there, which would make the statement correct.