We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,258 News Articles

‘Breathtaking’ hole in Adobe Reader plugin

Security threat to websites hosting PDFs

Security researchers are warning website publishers of a "breathtaking" weakness in the web browser plugin for Adobe's Acrobat Reader program.

The problem was first highlighted by Stefano Di Paola and Giorgio Fedon, researchers who presented a paper in Berlin last week on security issues related to Web 2.0 technologies such as AJAX (Asynchronous JavaScript and extensible markup language).

The Acrobat weakness involves a feature called "open parameters" in the web browser plugin for Adobe's Reader program.

The plugin allows arbitrary JavaScript code to run on the client side. The code could include a malicious attack on a computer, wrote Hon Lau on Symantec's Security Response blog.

"The ease in which this weakness can be exploited is breathtaking," Lau wrote. "What this means in a nutshell is that anybody hosting a .pdf, including well-trusted brands and names on the web, could have their trust abused and become unwilling partners in crime."

Any website hosting a .pdf file could be manipulated to run an exploit, Lau wrote. Because an exploit is relatively easy to craft, Lau predicted attacks will start until it is fixed.

In their research paper, Di Paola and Fedon wrote that the type of attack used to exploit the problem is called universal cross-site scripting, which uses a flaw in the browser rather than a vulnerability within a website. A cross-site scripting attack involves the unintended execution of code as part of a query string contained within a URL (uniform resource locator).

Another Symantec blogger, Zulfikar Ramzan, wrote that attackers can exploit a cross-scripting vulnerability by creating a special URL that points to the web page. In that URL, the attacker would code it to include some of his own content - such as a form soliciting passwords or credit-card information - that would be displayed on the targeted webpage.

When victims click on the URL - which, for example, could be included in a link enclosed in email - they would be directed to the webpage. If they fill out information on a form on the page, it could be passed to the attacker without the victim knowing the site had been tampered with, Ramzan wrote.

"The result is that the user is lulled into a false sense of security since he trusts the site and therefore trusts any transaction he has with it, even though in reality he is transacting with an attacker," Ramzan wrote.

In highlighting the problem with the Reader plugin, the researchers Di Paola and Fedon warned that Web 2.0 applications - such as Google's Gmail and Google Maps, both of which employ AJAX - will need to be more tightly tied to the security of web browsers.

Otherwise, the plethora of features in those applications "can be turned into weapons if controlled by a malicious hacker," they wrote.


IDG UK Sites

Amazon Kindle Voyage release date, price and specs UK: a high-end eReader with Amazon’s best-ever...

IDG UK Sites

Why local multiplayer gaming is rapidly vanishing: we look at the demise of split-screen and LAN...

IDG UK Sites

How to successfully bridge the gap between clients and creatives

IDG UK Sites

How to update your iPhone or iPad to iOS 8: including how to install iOS 8 if you don't have room