Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50 CVEs in 50 Days: Fuzzing Adobe Reader

research.checkpoint.com

Post reply on HN
Print view View original

41–50 of 173 posts

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#41

Post by saagarjha »

eganist wrote: post #28
rixrax wrote: post #19

I recall listening to a presentation in RSAC around 2013 or 2014 where Adobe CISO or CIO or someone pretty much said that they don’t give fucks about product security. E.g. zero impact on sales. I suspect it was thrown in as a bit of trolling attempt in a conversation but looking at their track record maybe that is the reality.

> they don’t give fucks about product security. More accurately stated as "we sandboxed it, so anything discovered is less likely to be critical." https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/sa... I've heard a variant of that talk delivered by a non-C-level at an appsec/prodsec-focused conference where the rehashed quote above (though I'm blatantly paraphrasing) was the justification used. Something mor…

Except somehow we still end up with horrendous security vulnerabilities in both. Putting things in a sandbox does not necessarily mean that you did it correctly.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#42

Post by ryacko »

devwastaken wrote: post #26

It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.

90% of PDFs could be replaced using a background PNG/JPEG file and a visible/invisible text overlay.

Instead of forms embedded in the “.phd”, one could just use HTML forms and and then use javaScript to export it as a “.phd” document, covering 99% of PDF use cases.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#43

Post by joshschreuder »

devwastaken wrote: post #26

It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.

Isn't that sort of what MHTML is?

https://en.wikipedia.org/wiki/MHTML

I remember saving .mht files with IE as a kid when working on assignments so I could disconnect the dialup and give my parents their phone line back :)

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#44

Post by AnaniasAnanas »

sebazzz wrote: post #18
SlowRobotAhead wrote: post #16

Earlier quoted context omitted.

I don’t know if this is true, but I’ve been told that the pdf spec at one point did/does contain some MS DOS emulation. I’m seriously close to banning acrobat the program for my employees, just haven’t found a rock solid alternative that I can trust to not implement the same dumb parts of the spec.

Pretty sure that pdf.js from Firefox is safe. At least it runs as sandboxed javascript in the browser. I believe a standalone client may exist as well.

My issue with pdf.js is that it is really bad at copying. every time that I try to copy something from it every word (and sometimes different letters from a word) end up in a different line. I also had issues with rendering, in some (rare) cases I had it show squares instead of the actual content.

Not to mention that it is actually horrifyingly slow compared to most of the viewers that I tried.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#45

Post by arianvanp »

megous wrote: post #33
devwastaken wrote: post #30

Earlier quoted context omitted.

I don't know how accurate that is for PDF's, but webpages are supposed to look the same, and given known compatible styling, it should be on any modern browser. Browsers are extremely consistent in content presentation, that's why webpages from early 2000s still look the same.

No. Take for example font-family: sans-serif. That can look like anything, can have different widths on different devices, etc. Browser windows can have any size, devices can have various pixel densities, users can work at different zoom levels, etc. The previous big thing was responsive design.

Same counts for PDFs. If the font isn't shipped inside the bundle, the PDF will look like shit.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#46

Post by avian »

sebazzz wrote: post #18
SlowRobotAhead wrote: post #16

Earlier quoted context omitted.

I don’t know if this is true, but I’ve been told that the pdf spec at one point did/does contain some MS DOS emulation. I’m seriously close to banning acrobat the program for my employees, just haven’t found a rock solid alternative that I can trust to not implement the same dumb parts of the spec.

Pretty sure that pdf.js from Firefox is safe. At least it runs as sandboxed javascript in the browser. I believe a standalone client may exist as well.

pdf.js had its share of security vulnerabilities in the past. e.g. https://blog.mozilla.org/security/2015/08/06/firefox-exploit...

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#47

Post by rixrax »

saagarjha wrote: post #41
eganist wrote: post #28

Earlier quoted context omitted.

> they don’t give fucks about product security. More accurately stated as "we sandboxed it, so anything discovered is less likely to be critical." https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/sa... I've heard a variant of that talk delivered by a non-C-level at an appsec/prodsec-focused conference where the rehashed quote above (though I'm blatantly paraphrasing) was the justification used. Something mor…

Except somehow we still end up with horrendous security vulnerabilities in both. Putting things in a sandbox does not necessarily mean that you did it correctly.

Exactly this. Thank You.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#48

Post by occamrazor »

SlowRobotAhead wrote: post #16
time-domain0 wrote: post #5

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

I don’t know if this is true, but I’ve been told that the pdf spec at one point did/does contain some MS DOS emulation. I’m seriously close to banning acrobat the program for my employees, just haven’t found a rock solid alternative that I can trust to not implement the same dumb parts of the spec.

I think that chrome uses (used?) poppler, and is quite good for displaying pdfs.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#50

Post by occamrazor »

devwastaken wrote: post #26

It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.

.chm (windows help files format) is almost exactly that. It had its fair share of security vulnerabilities.
Post reply on HN