3 ms·

After years of consistent security flaws in Flash and Reader, why does anyone allow Adobe software to accept untrusted input from the Internet?

blablabla123 14y ago
Because most content is from untrusted sources? ;) Anyway, on my Windows computer I uninstalled it last week and installed Foxit. Too bad so many Websites still need Flash.
- meaty 14y ago
  Hmm... http://www.h-online.com/security/news/item/Current-Foxit-Reader-can-execute-malicious-code-1780636.html http://www.h-online.com/security/news/item/Current-Foxit-Rea... Plenty more to come I reckon.
  - blablabla123 14y ago
    Damn... So either I stick with an even less common reader or I go back to Acrobat, they are able to fix faster. On the other hand I didn't install the Foxit Reader Plugin. I got the habit to not install PDF Reader plugins because they make browser freeze and crash even without vulnerabilities...
    - meaty 14y ago
      If you're just reading, use Chrome's built in PDF reader or PDFjs for Firefox [1] [1] https://addons.mozilla.org/en-US/firefox/addon/pdfjs/ https://addons.mozilla.org/en-US/firefox/addon/pdfjs/
- bmm6o 14y ago
  I like Foxit too, but people should be aware that you have to opt-out of some shitty crap-ware toolbar during installation.
  - blablabla123 14y ago
    Times change, IIRC Chrome suffers the same problem.
zurn 14y ago
Because the unwashed masses don't care about security, the push for security comes from various institutions trying to make fewer PCs botnet-controlled. The masses would have moved off Windows and IE already in the days of the ActiveX holes if they cared, but instead Microsoft kept customers happy by keeping it on for years and years.
saurik 14y ago
Because most alternative PDF renderers have been worse? Charlie Miller did an analysis once, fuzzing various engines, and Adobe's actually came out on top. (Combine this then with personal experience tangentially gained during JailbreakMe 2.0 and 3.0, and I now refuse to allow Apple's PDF renderer to ever open a file on my system, and always make certain to have Adobe Reader installed on my Macs.)
- FreakLegion 14y ago
  There's a difference between theoretical and practical security, though. On Windows everyone targets Adobe's products, because everyone uses them, thus they present the biggest attack surface. So while e.g. Acrobat may be more secure in theory, in practice it's the least secure of all. If OS X ships with a built-in PDF viewer then it probably presents the bigger attack surface, thus could be less secure than Adobe's products in that case. But as an individual (non-enterprise) user, statistically you'd still be better off with some niche third-party offering.
  - saurik 14y ago
    Most of the "niche" renderers use the same codebase (or at best only rely on large common libraries like FreeType); the JailbreakMe 2/3 exploits, for example, were able to affect almost all of them (its payload simply assumed it was trapped in MobileSafari and wanted root on an iPhone, but on systems without codesign I believe it could have affected just about everyone fairly generally). The thing that Adobe has going for it is that when there is a bug, they tend to fix it, they fix it correctly (JailbreakMe 3 shouldn't have been possible), and the fix is pushed quickly to users via automatic update prompts.
- zurn 14y ago
  > Charlie Miller did an analysis once, fuzzing various engines, and Adobe's actually came out on top The CanSecWest slides I found had him fuzzing standalone "PDF applications". This whole problem is because of handing random stuff from the internet to third party native code! Nowadays the browsers are in a class of their own wrt security. So use the PDF readers built into browsers, Chrome has one tended to by their security ninjas and Firefox has one running in their battle-hardened Javascript sandbox.
gcb0 14y ago
Because they are masters of lock-in. I just tried out every single open source or adobe-reader alternative for my wife to read university issued material in PDF. the only one that could render the documents correctly was adobe reader. So, that's what she is using, with all the vulnerabilities. every hour adobe acrobat will add some garbage or do something different with the files it output, that you can only read them in adobe reader. Only printers should have to read PDFs. if even...

blablabla123 14y ago

Because most content is from untrusted sources? ;) Anyway, on my Windows computer I uninstalled it last week and installed Foxit. Too bad so many Websites still need Flash.

meaty 14y ago
Hmm... http://www.h-online.com/security/news/item/Current-Foxit-Reader-can-execute-malicious-code-1780636.html http://www.h-online.com/security/news/item/Current-Foxit-Rea... Plenty more to come I reckon.
- blablabla123 14y ago
  Damn... So either I stick with an even less common reader or I go back to Acrobat, they are able to fix faster. On the other hand I didn't install the Foxit Reader Plugin. I got the habit to not install PDF Reader plugins because they make browser freeze and crash even without vulnerabilities...
  - meaty 14y ago
    If you're just reading, use Chrome's built in PDF reader or PDFjs for Firefox [1] [1] https://addons.mozilla.org/en-US/firefox/addon/pdfjs/ https://addons.mozilla.org/en-US/firefox/addon/pdfjs/
bmm6o 14y ago
I like Foxit too, but people should be aware that you have to opt-out of some shitty crap-ware toolbar during installation.
- blablabla123 14y ago
  Times change, IIRC Chrome suffers the same problem.

zurn 14y ago

Because the unwashed masses don't care about security, the push for security comes from various institutions trying to make fewer PCs botnet-controlled. The masses would have moved off Windows and IE already in the days of the ActiveX holes if they cared, but instead Microsoft kept customers happy by keeping it on for years and years.

saurik 14y ago

Because most alternative PDF renderers have been worse? Charlie Miller did an analysis once, fuzzing various engines, and Adobe's actually came out on top. (Combine this then with personal experience tangentially gained during JailbreakMe 2.0 and 3.0, and I now refuse to allow Apple's PDF renderer to ever open a file on my system, and always make certain to have Adobe Reader installed on my Macs.)

FreakLegion 14y ago
There's a difference between theoretical and practical security, though. On Windows everyone targets Adobe's products, because everyone uses them, thus they present the biggest attack surface. So while e.g. Acrobat may be more secure in theory, in practice it's the least secure of all. If OS X ships with a built-in PDF viewer then it probably presents the bigger attack surface, thus could be less secure than Adobe's products in that case. But as an individual (non-enterprise) user, statistically you'd still be better off with some niche third-party offering.
- saurik 14y ago
  Most of the "niche" renderers use the same codebase (or at best only rely on large common libraries like FreeType); the JailbreakMe 2/3 exploits, for example, were able to affect almost all of them (its payload simply assumed it was trapped in MobileSafari and wanted root on an iPhone, but on systems without codesign I believe it could have affected just about everyone fairly generally). The thing that Adobe has going for it is that when there is a bug, they tend to fix it, they fix it correctly (JailbreakMe 3 shouldn't have been possible), and the fix is pushed quickly to users via automatic update prompts.
zurn 14y ago
> Charlie Miller did an analysis once, fuzzing various engines, and Adobe's actually came out on top The CanSecWest slides I found had him fuzzing standalone "PDF applications". This whole problem is because of handing random stuff from the internet to third party native code! Nowadays the browsers are in a class of their own wrt security. So use the PDF readers built into browsers, Chrome has one tended to by their security ninjas and Firefox has one running in their battle-hardened Javascript sandbox.

gcb0 14y ago

Because they are masters of lock-in. I just tried out every single open source or adobe-reader alternative for my wife to read university issued material in PDF. the only one that could render the documents correctly was adobe reader. So, that's what she is using, with all the vulnerabilities. every hour adobe acrobat will add some garbage or do something different with the files it output, that you can only read them in adobe reader. Only printers should have to read PDFs. if even...