Live data from Hacker News

50 CVEs in 50 Days: Fuzzing Adobe Reader

research.checkpoint.com

11–20 of 173 posts

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#11

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

I was under the impression that PDF was created as a response to postscript being "too programmable" and not "document enough" but then they decided that PDF is too minimal and so they ended up bloating it beyond what PostScript ever was by including JavaScript, Flash, and other trash in it.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#13

Do people still use Adobe reader nowadays? Last time that I tried it in my school's library it took half a minute to load and render my document, and after that the whole UI was unresponsive. I had a much better experience with Sumatra on windows and Zathura on Linux where my documents open almost instantly.

.. tried Zathura on LUbuntu just now for the first time ; appears to be a VIM for documents viewing or something.. no interest in Zathura here!

What do you use? I also had good experiences with Okular in the past but I have not tried it in ages. Before moving to zathura I used xpdf and evince but I was not satisfied by them (not to mention that they do not support postscript and djvu).

Zathura does have some vim keybinds but other than that I can't see any similarities.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#14

Do people still use Adobe reader nowadays? Last time that I tried it in my school's library it took half a minute to load and render my document, and after that the whole UI was unresponsive. I had a much better experience with Sumatra on windows and Zathura on Linux where my documents open almost instantly.

.. tried Zathura on LUbuntu just now for the first time ; appears to be a VIM for documents viewing or something.. no interest in Zathura here!

and just like that, you've convinced me to install it. Different strokes for different folks, I suppose. :)

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#15

Do people still use Adobe reader nowadays? Last time that I tried it in my school's library it took half a minute to load and render my document, and after that the whole UI was unresponsive. I had a much better experience with Sumatra on windows and Zathura on Linux where my documents open almost instantly.

Libpoppler has poor support for PDF Forms (especially Unicode[1][2]), embedded animation and 3D extensions. In my opinion these areas are very important in real world document exchange to be ignored (as it is a case for PDF FOSS tools).

[1] https://bugs.freedesktop.org/show_bug.cgi?id=17913

[2] https://gitlab.freedesktop.org/poppler/poppler/issues/463

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#16

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

I don’t know if this is true, but I’ve been told that the pdf spec at one point did/does contain some MS DOS emulation.

I’m seriously close to banning acrobat the program for my employees, just haven’t found a rock solid alternative that I can trust to not implement the same dumb parts of the spec.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#17
post #15

Do people still use Adobe reader nowadays? Last time that I tried it in my school's library it took half a minute to load and render my document, and after that the whole UI was unresponsive. I had a much better experience with Sumatra on windows and Zathura on Linux where my documents open almost instantly.

Libpoppler has poor support for PDF Forms (especially Unicode[1][2]), embedded animation and 3D extensions. In my opinion these areas are very important in real world document exchange to be ignored (as it is a case for PDF FOSS tools). [1] https://bugs.freedesktop.org/show_bug.cgi?id=17913 [2] https://gitlab.freedesktop.org/poppler/poppler/issues/463

I have never seen anyone use any of these features in the real world. I presume that embedded animation and 3D extensions are used in art-related fields? If so that would explain my ignorance.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#18

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

I don’t know if this is true, but I’ve been told that the pdf spec at one point did/does contain some MS DOS emulation. I’m seriously close to banning acrobat the program for my employees, just haven’t found a rock solid alternative that I can trust to not implement the same dumb parts of the spec.

Pretty sure that pdf.js from Firefox is safe. At least it runs as sandboxed javascript in the browser. I believe a standalone client may exist as well.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#19
I recall listening to a presentation in RSAC around 2013 or 2014 where Adobe CISO or CIO or someone pretty much said that they don’t give fucks about product security. E.g. zero impact on sales. I suspect it was thrown in as a bit of trolling attempt in a conversation but looking at their track record maybe that is the reality.
Post reply on HN