Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50 CVEs in 50 Days: Fuzzing Adobe Reader

research.checkpoint.com

Post reply on HN
Print view View original

81–90 of 173 posts

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#81

Post by ernst_klim »

ungzd wrote: post #74
ernst_klim wrote: post #59

Earlier quoted context omitted.

Is djvu a viable alternative and if so, why isn't it used as widely as pdf?

DJVU is raster format. It's intended for scans and archiving printed media. It's possible to use it for documents produced digitally, but I don't think it will be a good idea. PDF "core" is not that bad, but 90s "multimedia" craze turned it into badly designed graphical application runtime.

Thanks for disambiguation, the raster-vector part is really a major difference. Is PS a viable alternative (even though it is a programming language itself)?

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#82

Post by TeMPOraL »

Being able to run JS in a PDF sounds scary to a lot of people, but I wouldn't throw that idea out entirely.

If you follow the work by Bret Victor & others on "explorable explanations"[0][1] and interactive scientific papers[2], you probably appreciate the need for a self-contained format for interactive documents. Could PDF be this? I don't know, I hear the spec is too scary. But I'd say we should have something like that.

--

[0] - https://explorabl.es/

[1] - http://worrydream.com/ExplorableExplanations/

[2] - http://worrydream.com/ScientificCommunicationAsSequentialArt...

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#83

Post by oblio »

AnaniasAnanas wrote: post #17
xvilka wrote: post #15

Earlier quoted context omitted.

Libpoppler has poor support for PDF Forms (especially Unicode[1][2]), embedded animation and 3D extensions. In my opinion these areas are very important in real world document exchange to be ignored (as it is a case for PDF FOSS tools). [1] https://bugs.freedesktop.org/show_bug.cgi?id=17913 [2] https://gitlab.freedesktop.org/poppler/poppler/issues/463

I have never seen anyone use any of these features in the real world. I presume that embedded animation and 3D extensions are used in art-related fields? If so that would explain my ignorance.

PDF forms are super common for government interactions in many countries. Good luck ignoring those!

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#84

Post by jeeceebees »

TeMPOraL wrote: post #82

Being able to run JS in a PDF sounds scary to a lot of people, but I wouldn't throw that idea out entirely. If you follow the work by Bret Victor & others on "explorable explanations"[0][1] and interactive scientific papers[2], you probably appreciate the need for a self-contained format for interactive documents. Could PDF be this? I don't know, I hear the spec is too scary. But I'd say we should have something like…

Distill[1] is another example of interactive scientific papers (with a focus on machine learning).

But is there really a good reason to not just keep these in browser? I don't really know if there's much value in reading these locally. Maybe this would be a good fit for an electron app?

[1] https://distill.pub/

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#85

Post by microtonal »

fghtr wrote: post #68

If you have a PDF document on your web site, please consider putting a link to https://pdfreaders.org/ instead of unfair advertisement of Adobe Reader.

Which gives (except for pdf.js) more PDF readers written in C, some with a long history of CVEs, and typically not sandboxed by default.

Since many people are using a PDF reader to read PDFs from relatively untrusted sources, do yourself a favor and at least use a reader that does not have full system access.

macOS: Preview.app (uses macOS sandboxing)

Linux: Evince Flatpak on Wayland (Flatpak uses sandboxing. Wayland because X11 apps can read all keystrokes, mouse events, do screengrabs.)

Windows: no clue

All platforms: in-browser PDF reader with a browser that sandboxes.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#86

Post by lbriner »

Acrobat Reader has been the poster boy for poor software for many years and it appears that Adobe have been good at adding new features to make it largely impossible for their competitors to keep up.

What is one to do?

Surely, the obvious answer is to ringfence PDF (or another new format) for the most basic features. These could more easily be handled by 3rd-party apps both securely and to render correctly. Let Adobe do whatever they want with their own format by adding loads of stuff people don't want, then the sell is harder for them:

Get a cheaper, safer app for writing portable docs which can do most things or pay more money for a very insecure format that does stuff you don't need.

I assume that others have attempted at some point to make an OSS alternative to PDF and I'm guessing it hasn't worked yet?

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#87

Post by rvp-x »

microtonal wrote: post #85
fghtr wrote: post #68

If you have a PDF document on your web site, please consider putting a link to https://pdfreaders.org/ instead of unfair advertisement of Adobe Reader.

Which gives (except for pdf.js) more PDF readers written in C, some with a long history of CVEs, and typically not sandboxed by default. Since many people are using a PDF reader to read PDFs from relatively untrusted sources, do yourself a favor and at least use a reader that does not have full system access. macOS: Preview.app (uses macOS sandboxing) Linux: Evince Flatpak on Wayland (Flatpak uses sandboxing. Wayland…

If you're counting on wayland to sandbox arbitrary code execution, you're getting in trouble.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#88

Post by acqq »

devwastaken wrote: post #78
acqq wrote: post #67

Earlier quoted context omitted.

Opera 12 (the original one, before the managers decided that it should be based on Chromium) had the .zip files support built in; that means that if the URL was somepath/archive.zip/index.html and index.html refers to other files, they would be read from the same zip, even if they are only inside of the zip. I used it a lot for the local archives of the bigger content, it is amazingly convenient, and I'm sad that the…

The reason I don't suggest zip is due to it's insecurity, like zip bombing. Itd be better for archival if we just had tar, and then sometime lightweight on top of it if compression is wanted. That way you could have js generate the archive client side. It is interesting how the older web got some things right, though, and now it's 2018 and those ideas one would think should be robust by now, isn't even there.

Zip is not inherently insecure anymore than any other URL parsing and archive handling is. Technically it's many orders of magnitude better solution for the random access (due to the existence of the central directory as I've already mentioned) than tar-gz, if it's done right.

Out of every archive format a pathological case can be constructed, just like it can from the relative file names etc, but such attempts can be simply rejected during the processing once some thresholds are reached. The original article demonstrates that JPG reading implementation can be bad enough, and the same can be said for every format, even text based. It simply has to be done right (including fuzzing at the end).

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#89

Post by [deleted] »

devwastaken wrote: post #26

It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.

[deleted]

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#90

Post by SmellyGeekBoy »

zubspace wrote: post #55
time-domain0 wrote: post #5

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

While working with the PDF format I sometimes get the impression that this complexity is what Adobe wants. As a result, Adobe Reader is the only viewer that implements the entire spec and can handle all (or most) quirks. This is especially apparent when trying to edit arbitrary PDF files, which is sometimes not so easy or even impossible. Just the definition of fonts and the text layout is already so complicated that…

The same could be said for the Microsoft Office file formats.

Or PSD, for that matter.

Post reply on HN