Live data from Hacker News

50 CVEs in 50 Days: Fuzzing Adobe Reader

research.checkpoint.com

121–130 of 173 posts

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#121

Earlier quoted context omitted.

PDFs are supposed to look the same on every computer. Webpages can’t do that yet.

I don't know how accurate that is for PDF's, but webpages are supposed to look the same, and given known compatible styling, it should be on any modern browser. Browsers are extremely consistent in content presentation, that's why webpages from early 2000s still look the same.

> I don't know how accurate that is for PDF's, but webpages are supposed to look the same,

One of Adobe's early talking points for the value of PDF's was that they would "look the same on all systems". Of course some context is necessary. PDF first appeared in 1993. In 1993, while the internet did exist, most individuals who were not associated with a university, research lab, or govt. agency, had no access to 'the internet'.

As well, the computing world was much more diverse. One had Dos, early Windows, and various MacOS variants all coexisting, one had numerous different variants of Unix on the numerous different RISC workstations in existence. And, here was the big deal, 'documents' created on each of these systems were to a large extent incompatible with each other. In this context, 'document' should be thought of as "a file used to create paper printouts" as opposed to what we think of a 'document' now in 2018. There was some compatibility, in that Windows systems would, sometimes, read 'documents' produced by Dos based word processors, and of course the lowest common denominator, plain text file, was 'almost' compatible (line ending differences was the biggest incompatibility). But for anything more complicated, if person X created a 'document' on Dos, and they wanted person Y, using SunOS, to see a version that "looked the same", their best bet was to print their document to paper and give Y the printer output. Because if they could send the electronic file to Y somehow, chances were that Y would be unable to open it, and even if they could, there was a good chance that it did not 'look the same' (from a 'looks like the same paper printout' level of same).

PDF came about in this world where paper was still king, and Adobe's marketing of "looks the same" was really meant to be "produces the same paper printout for the receiver Y as it does for creator X". That is why, today, in 2018, that viewing a PDF still looks like one is viewing WYSIWYG of a paper printout. PDF is, quite intimately, tied to the concept that there are discrete sheets of paper that it is formatting data onto. Yes some viewers do provide an 'almost' HTML continuous scroll look, but that is done 100% in the viewer, the underlying PDF format is very paper page oriented at its core.

So, when comparing PDF intent to web page intent, the phrase "looks the same" has different meanings. For PDF, it was designed such that "looks the same" means that a paper printout looks identical to the original. And that the designer/creator has full control over the look, while the viewer has no control over the look. For web pages, "looks the same" is far less strict, and is really not the same meaning, because the web was always intended to allow the viewer much freedom in deciding how to display the HTML content, taking away the designers ability to strictly determine look and presentation. With the result that HTML data was never meant to "look the same" with the same strictness intended by PDF.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#122
post #112

Earlier quoted context omitted.

You can write self contained, single file .html documents just fine.

Not when you need images, and if you need to display 3D data you are required to actually serve textures over a server.

You can embed images in the HTML as well

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#123

As much as many of us lament the state of much of today's software, if you think of products from a certain era - IE6, Flash, Java web applets - they all had a commonality in their code quality. These are mostly a non-issue these days, but it's not because they suddenly stopped having bugs and still get active use. I remember rolling out Adobe Reader in those days and as a product, I don't believe its core has change…

To be fair, in my experience Chrome's and Firefox's PDF viewers don't cut it. They are good for a quick preview, but especially when printing they occasionally render things slightly wrong, which is unacceptable for a file format whose entire point is to look the same everywhere. Also forms. That doesn't mean that there aren't any alternatives. Foxit for example is pretty good. But in-browser alternatives just aren't…

I've never noticed rendering errors, but my problem with the browser built-in PDF viewers is that they can't handle big complex PDFs, especially on older machines. They'll gobble up 4GB of RAM like it's nothing and start swapping on PDFs that Acroread or xpdf display in less than a second.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#124

Earlier quoted context omitted.

PDFs are supposed to look the same on every computer. Webpages can’t do that yet.

I don't know how accurate that is for PDF's, but webpages are supposed to look the same, and given known compatible styling, it should be on any modern browser. Browsers are extremely consistent in content presentation, that's why webpages from early 2000s still look the same.

What? Lot's of webpages look different after simply resizing the window! The fact that this is on purpose, doesn't mean it doesn't happen (quite the opposite!).

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#125
post #62
post #23

Earlier quoted context omitted.

I was also convinced to install it, although after trying it, it looks more like less for PDFs than vim for PDFs (as many of the commands search or scroll in complex ways, but none of them modify the PDF). Still, it's interesting to have something like less for PDFs!

IMO mupdf is the real less for PDFs. It is so lightweight and straightforward it makes everything else seem terribly bloated.

Zathura can use mupdf as its PDF renderer (it can also use poppler). I like using the mupdf library through Zathura rather than using the mupdf application, because Zathura has plugins for other file formats too, like PostScript and DJVU, and that way I learn a single set of keystrokes to view all sorts of documents.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#126

Earlier quoted context omitted.

Is such a link even still neccessary? Edge, firefox and chrome have built in PDF readers. For more control sites can self-embed pdfjs so no external reader is required.

Unfortunately, yes it is. Just yesterday, my wife tried to open a pdf transcript from her college. It would not open on anything other that Adobe Reader on a traditional os, putting it out of reach for her, being an Android/Chromebook user. Neither Chrome nor Google Drive/Docs could open it. And I could only open it in Adobe Reader on my laptop - not Firefox, not Chrome, and not whatever default viewer my laptop has.…

Yeah official transcripts from my undergrad have (or had, haven't needed one in a while) some sort of authentication thing. Fortunately adobe reader for Linux was still supported when I needed one...

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#127

As much as many of us lament the state of much of today's software, if you think of products from a certain era - IE6, Flash, Java web applets - they all had a commonality in their code quality. These are mostly a non-issue these days, but it's not because they suddenly stopped having bugs and still get active use. I remember rolling out Adobe Reader in those days and as a product, I don't believe its core has change…

To be fair, in my experience Chrome's and Firefox's PDF viewers don't cut it. They are good for a quick preview, but especially when printing they occasionally render things slightly wrong, which is unacceptable for a file format whose entire point is to look the same everywhere. Also forms. That doesn't mean that there aren't any alternatives. Foxit for example is pretty good. But in-browser alternatives just aren't…

Dumb question:

Why can't we just burn PNGs[0] or lossless JPEGs and just use OCR / other simple machine learning for text selection? Like, I get that there are some unfortunate souls out there that need to edit CAD documents in their PDF but for 99.999% of people PDFs do one thing that websites do not:

Print reliably well given a page format like A4.

I shouldn't have to wince ever time I open a PDF. They're so insecure that a no-click RCE only fetches $10k.

[0] Or ideally SVG, but there are some problems with fonts and licensing that I'm struggling to remember at the moment.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#128
post #112

Earlier quoted context omitted.

Not when you need images, and if you need to display 3D data you are required to actually serve textures over a server.

You can embed images in the HTML as well

Sure, if you resort to tricks like Base64 encoding in strings, that won't do for WebGL textures though.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#129

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

What do you mean "read"? Implemented.

Though obviously not the full thing. Nobody does that. Not even Adobe does that.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#130

Earlier quoted context omitted.

To be fair, in my experience Chrome's and Firefox's PDF viewers don't cut it. They are good for a quick preview, but especially when printing they occasionally render things slightly wrong, which is unacceptable for a file format whose entire point is to look the same everywhere. Also forms. That doesn't mean that there aren't any alternatives. Foxit for example is pretty good. But in-browser alternatives just aren't…

Dumb question: Why can't we just burn PNGs[0] or lossless JPEGs and just use OCR / other simple machine learning for text selection? Like, I get that there are some unfortunate souls out there that need to edit CAD documents in their PDF but for 99.999% of people PDFs do one thing that websites do not: Print reliably well given a page format like A4. I shouldn't have to wince ever time I open a PDF. They're so insecu…

Accessibility, plus print is at ridiculous DPI compared to screen. To achieve compression you want to use the fact that there is a font being repeated across the page. OCR just isn't good enough.
Post reply on HN