We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

McAfee spots Adobe Reader PDF-tracking flaw

A flaw in Adobe Reader could allow an attacker to see when and where a PDF is opened.

McAfee said it has found a vulnerability in Adobe Systems' Reader program that reveals when and where a PDF document is opened.

The issue is not a serious problem and does not allow for remote code execution, wrote McAfee's Haifei Li in a blog post. But McAfee does consider it a security problem and has notified Adobe. It affects every version of Adobe Reader, including the latest version, 11.0.2, Li wrote.

McAfee recently detected some "unusual" PDF samples, Li wrote. McAfee withheld some key details of the vulnerability, but did generally describe it.

The issue occurs when someone launches a link to another file path, which calls on a JavaScript API (application programming interface). Reader warns a user when they are going to call on a resource from another place, such as a link on the Internet.

If the external resource does not exist, the warning dialog does not appear, but the API returns some TCP traffic, Li wrote. By manipulating a second parameter with a special value, the API's behavior changes to reveal information. That could include information such as the location of a document on a system "by calling the JavaScript 'this.path' value," Li wrote.

"Malicious senders could exploit this vulnerability to collect sensitive information such as IP address, Internet service provider or even the victim's computing routine," Li wrote. "In addition, our analysis suggests that more information could be collected by calling various PDF JavaScript APIs."

Li suggests the problem could be used for reconnaissance by attackers.

"Some people might leverage this issue just out of curiosity to know who has opened their PDF documents, but others won't stop there," Li wrote. "An APT [advanced persistent threat] attack usually consists of several sophisticated steps. The first step is often collecting information from the victim; this issue opens the door."

McAfee suggests that Adobe Reader users disable JavaScript until a patch is released. Adobe officials could not be immediately reached for comment.

Send news tips and comments to [email protected] Follow me on Twitter: @jeremy_kirk


IDG UK Sites

Where to buy iPhone 6 and iPhone 6 Plus in the UK: Launch day price, deals and contracts

IDG UK Sites

Is Apple losing confidence in itself?

IDG UK Sites

Professional photo and video techniques for perfect colours

IDG UK Sites

How (and where) to buy an iPhone 6 or iPhone 6 Plus in the UK. Plus: What to do if you pre-ordered...