Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50 CVEs in 50 Days: Fuzzing Adobe Reader

research.checkpoint.com

Post reply on HN
Print view View original

141–150 of 173 posts

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#141

Post by intertextuality »

da_chicken wrote: post #132
3pt14159 wrote: post #127

Earlier quoted context omitted.

Dumb question: Why can't we just burn PNGs[0] or lossless JPEGs and just use OCR / other simple machine learning for text selection? Like, I get that there are some unfortunate souls out there that need to edit CAD documents in their PDF but for 99.999% of people PDFs do one thing that websites do not: Print reliably well given a page format like A4. I shouldn't have to wince ever time I open a PDF. They're so insecu…

Because OCR is expensive (to write as software and to process for the end user) and very error prone, especially if your text is anything other than a 12 point black font in on a white background with no formatting (italics, underlines, etc.). If my document's information is valuable, I'm not going to be willing to rely on the quality of my recipient's OCR software to get a digitally readable copy of my work. I mean,…

> Then again, I imagine it won't be long before someone mentions LaTeX as a viable alternative, even though the one thing LaTeX isn't is portable. But LaTeX is primarily popular in the tech community because it lets programmers pretend to write code

Rude remarks notwithstanding, LaTeX and its ilk let you make PDFs, which are indeed portable. Setting up LaTeX is the same as setting up any other program, some of which are not portable either. ShareLatex.com [0] also exists for the purpose of using LaTeX anywhere.

People recommend LaTeX because it's in another league when it comes to typesetting and rendering more niche notation. It's also not user hostile when it comes to binary files. LaTeX source files will always be readable decades later, makes no such guarantees.

Whether it's a viable alternative depends on whether the user wants to make a minimal learning investment or not. If they don't, google sheets > export to pdf always exists.

[0]: https://www.sharelatex.com/

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#142

Post by Liquid_Fire »

yjftsjthsd-h wrote: post #116
joneser005 wrote: post #106

Earlier quoted context omitted.

Unfortunately, yes it is. Just yesterday, my wife tried to open a pdf transcript from her college. It would not open on anything other that Adobe Reader on a traditional os, putting it out of reach for her, being an Android/Chromebook user. Neither Chrome nor Google Drive/Docs could open it. And I could only open it in Adobe Reader on my laptop - not Firefox, not Chrome, and not whatever default viewer my laptop has.…

I think there used to be an official port of Adobe Reader to Android. Probably discontinued now, but it was a thing.

It's not discontinued, it's actively maintained (last updated 5 Nov 2018): https://play.google.com/store/apps/details?id=com.adobe.read...

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#143

Post by andrei-fuzzbuzz »

agumonkey wrote: post #2

What about having continuous fuzzing servers for just about any software ? kinda like virustotal.

We've been working on something like this for the past couple of months and we'll be launching in early/mid January![0] We've got experience working on large scale fuzzing infrastructure (Chrome fuzzing team, Coinbase fuzzing), and have modelled it similarly to Google's oss-fuzz[1], but for private projects and clouds.

We're always looking for companies and security researchers that want to fuzz but don't have the time/knowledge on how to do so (we automate a lot of the set up process and integrate nicely into your GitHub workflow) - drop me a line if you're interested - andrei@fuzzbuzz.io

[0] - https://fuzzbuzz.io

[1] - https://github.com/google/oss-fuzz

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#144

Post by Bhilai »

devy wrote: post #140

Honest question: why can't Adobe hire product security engineers to do this kind of vulnerability discoveries or even hire 3rd party consultants to fix bugs/vulnerabilities before they even get into production? Every CVEs exposed by outside 3rd parties like this is a shame on their software quality and reputation, IMMO.

This is a great question and I have thought a bunch about it and the only conclusion I could make is that they dont care enough. This kind of news does not affect Adobe's stock price or their profits. Their users probably mostly don't care. So why bother paying $$$ for security engineers.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#146

Post by Spivak »

executesorder66 wrote: post #103
technion wrote: post #66

As much as many of us lament the state of much of today's software, if you think of products from a certain era - IE6, Flash, Java web applets - they all had a commonality in their code quality. These are mostly a non-issue these days, but it's not because they suddenly stopped having bugs and still get active use. I remember rolling out Adobe Reader in those days and as a product, I don't believe its core has change…

> One large department then ordered Adobe Professional for every user. They told me they didn't need it, they just knew I wouldn't propose removing a product they'd actually paid for. Why would they do that though?

I'm assuming that they didn't actually need any of the professional features, they just saw it as a way to avoid having Adobe Reader/Acrobat removed from systems in favor of something they like less but admins like more.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#147

Post by danielhlockard »

rvp-x wrote: post #87
microtonal wrote: post #85

Earlier quoted context omitted.

Which gives (except for pdf.js) more PDF readers written in C, some with a long history of CVEs, and typically not sandboxed by default. Since many people are using a PDF reader to read PDFs from relatively untrusted sources, do yourself a favor and at least use a reader that does not have full system access. macOS: Preview.app (uses macOS sandboxing) Linux: Evince Flatpak on Wayland (Flatpak uses sandboxing. Wayland…

If you're counting on wayland to sandbox arbitrary code execution, you're getting in trouble.

I think they're counting on flatpak.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#148

Post by Spivak »

rvp-x wrote: post #87
microtonal wrote: post #85

Earlier quoted context omitted.

Which gives (except for pdf.js) more PDF readers written in C, some with a long history of CVEs, and typically not sandboxed by default. Since many people are using a PDF reader to read PDFs from relatively untrusted sources, do yourself a favor and at least use a reader that does not have full system access. macOS: Preview.app (uses macOS sandboxing) Linux: Evince Flatpak on Wayland (Flatpak uses sandboxing. Wayland…

If you're counting on wayland to sandbox arbitrary code execution, you're getting in trouble.

Applications that can send commands to X.org servers can completely control it. The same isn't true for Wayland.

Flatpak is providing the actual application sandboxing, but being allowed to talk to the X server is a huge amount of privilege that can't really be restricted.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#149

Post by vxNsr »

inferiorhuman wrote: post #31
AnaniasAnanas wrote: post #17

Earlier quoted context omitted.

I have never seen anyone use any of these features in the real world. I presume that embedded animation and 3D extensions are used in art-related fields? If so that would explain my ignorance.

PDF forms are used all over the place from what I can tell -- including a bunch of county government stuff I just had to deal with. No JS was involved though.

I've seen pretty heavy js usage on US gov forms, the most recent example being i9 form you fill out when you get hired.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#150

Post by mitchtbaum »

Adobe's software is large enough and ingrained deep enough that it seems people give it a pass with today's standards for software stability. Lowering the threshold of well-shaped review nearer to git and libgit2 would yield even more value toward stepping through the software stargate.

Git total loc: 279,993

libgit2 total loc: 219,887

Git CVEs (so far): https://www.cvedetails.com/vulnerability-list/vendor_id-4008...

libgit2 CVEs (so far): https://www.cvedetails.com/vulnerability-list/vendor_id-1606...

Post reply on HN