50 CVEs in 50 Days: Fuzzing Adobe Reader

#1

Post by benryon » Thu, Dec 13, 2018, 3:48 AM UTC

50 CVEs in 50 Days: Fuzzing Adobe Reader
research.checkpoint.com

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#2

Post by agumonkey » Thu, Dec 13, 2018, 4:53 AM UTC

What about having continuous fuzzing servers for just about any software ? kinda like virustotal.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#3

Post by Someone1234 » Thu, Dec 13, 2018, 4:57 AM UTC

agumonkey wrote: post #2

What about having continuous fuzzing servers for just about any software ? kinda like virustotal.

If you're talking about the developer of the software? Potentially. As to third parties, this article goes into painstaking detail on how difficult it is to set up fuzzing for closed source binaries.

You need to understand a certain amount of "rules" around each API call, and while you can duplicate their normal usage, there's a certain amount of thought that has to go into it.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#4

Post by brian_herman » Thu, Dec 13, 2018, 5:05 AM UTC

Awesome work!

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#5

Post by time-domain0 » Thu, Dec 13, 2018, 5:09 AM UTC

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#6

Post by arkadiyt » Thu, Dec 13, 2018, 5:10 AM UTC

agumonkey wrote: post #2

What about having continuous fuzzing servers for just about any software ? kinda like virustotal.

Google does this with their oss-fuzz project (only for open source projects, since as Someone1234 noted it's very difficult otherwise):

https://github.com/google/oss-fuzz

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#7

Post by brabara » Thu, Dec 13, 2018, 5:20 AM UTC

Wonder how many of these were already in use by state actors?

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#8

Post by AnaniasAnanas » Thu, Dec 13, 2018, 5:24 AM UTC

Do people still use Adobe reader nowadays? Last time that I tried it in my school's library it took half a minute to load and render my document, and after that the whole UI was unresponsive.

I had a much better experience with Sumatra on windows and Zathura on Linux where my documents open almost instantly.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#9

Post by touisteur » Thu, Dec 13, 2018, 5:28 AM UTC

arkadiyt wrote: post #6

agumonkey wrote: post #2

What about having continuous fuzzing servers for just about any software ? kinda like virustotal.

Google does this with their oss-fuzz project (only for open source projects, since as Someone1234 noted it's very difficult otherwise): https://github.com/google/oss-fuzz

Microsoft had 'project Springfield' which became 'Microsoft Security Risk Detection' (https://www.microsoft.com/en-us/security-risk-detection/). Kind of like Fuzzing as a Service.

Anyone on HN has any experience to report with this ?

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#10

Post by mistrial9 » Thu, Dec 13, 2018, 5:32 AM UTC

AnaniasAnanas wrote: post #8

Do people still use Adobe reader nowadays? Last time that I tried it in my school's library it took half a minute to load and render my document, and after that the whole UI was unresponsive. I had a much better experience with Sumatra on windows and Zathura on Linux where my documents open almost instantly.

.. tried Zathura on LUbuntu just now for the first time ; appears to be a VIM for documents viewing or something.. no interest in Zathura here!