Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50 CVEs in 50 Days: Fuzzing Adobe Reader

research.checkpoint.com

Post reply on HN
Print view View original

21–30 of 173 posts

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#21

Post by burfog »

AnaniasAnanas wrote: post #17
xvilka wrote: post #15

Earlier quoted context omitted.

Libpoppler has poor support for PDF Forms (especially Unicode[1][2]), embedded animation and 3D extensions. In my opinion these areas are very important in real world document exchange to be ignored (as it is a case for PDF FOSS tools). [1] https://bugs.freedesktop.org/show_bug.cgi?id=17913 [2] https://gitlab.freedesktop.org/poppler/poppler/issues/463

I have never seen anyone use any of these features in the real world. I presume that embedded animation and 3D extensions are used in art-related fields? If so that would explain my ignorance.

The PDF used to apply for the BSA's Eagle Scout rank needs that stuff. I believe the reason is related to expandable text fields that might need to insert pages into the document. None of the non-Adobe viewers can handle it.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#22

Post by xvilka »

AnaniasAnanas wrote: post #17
xvilka wrote: post #15

Earlier quoted context omitted.

Libpoppler has poor support for PDF Forms (especially Unicode[1][2]), embedded animation and 3D extensions. In my opinion these areas are very important in real world document exchange to be ignored (as it is a case for PDF FOSS tools). [1] https://bugs.freedesktop.org/show_bug.cgi?id=17913 [2] https://gitlab.freedesktop.org/poppler/poppler/issues/463

I have never seen anyone use any of these features in the real world. I presume that embedded animation and 3D extensions are used in art-related fields? If so that would explain my ignorance.

Art and engineering.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#23

Post by schoen »

kvakil wrote: post #14
mistrial9 wrote: post #10

Earlier quoted context omitted.

.. tried Zathura on LUbuntu just now for the first time ; appears to be a VIM for documents viewing or something.. no interest in Zathura here!

and just like that, you've convinced me to install it. Different strokes for different folks, I suppose. :)

I was also convinced to install it, although after trying it, it looks more like less for PDFs than vim for PDFs (as many of the commands search or scroll in complex ways, but none of them modify the PDF).

Still, it's interesting to have something like less for PDFs!

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#24

Post by kevin_thibedeau »

AnaniasAnanas wrote: post #17
xvilka wrote: post #15

Earlier quoted context omitted.

Libpoppler has poor support for PDF Forms (especially Unicode[1][2]), embedded animation and 3D extensions. In my opinion these areas are very important in real world document exchange to be ignored (as it is a case for PDF FOSS tools). [1] https://bugs.freedesktop.org/show_bug.cgi?id=17913 [2] https://gitlab.freedesktop.org/poppler/poppler/issues/463

I have never seen anyone use any of these features in the real world. I presume that embedded animation and 3D extensions are used in art-related fields? If so that would explain my ignorance.

I have to use Reader to fill out my state tax forms because they use some modern JavaScript driven system to auto fill that no other reader can handle.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#25

Post by kccqzy »

AnaniasAnanas wrote: post #17
xvilka wrote: post #15

Earlier quoted context omitted.

Libpoppler has poor support for PDF Forms (especially Unicode[1][2]), embedded animation and 3D extensions. In my opinion these areas are very important in real world document exchange to be ignored (as it is a case for PDF FOSS tools). [1] https://bugs.freedesktop.org/show_bug.cgi?id=17913 [2] https://gitlab.freedesktop.org/poppler/poppler/issues/463

I have never seen anyone use any of these features in the real world. I presume that embedded animation and 3D extensions are used in art-related fields? If so that would explain my ignorance.

A long time ago, when I used PDF exclusively as the format for my slides, I used features like animations and auto play videos embedded within PDFs. Very helpful if you want to give a presentation.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#26

Post by devwastaken »

It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#27

Post by saagarjha »

devwastaken wrote: post #26

It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.

PDFs are supposed to look the same on every computer. Webpages can’t do that yet.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#28

Post by eganist »

rixrax wrote: post #19

I recall listening to a presentation in RSAC around 2013 or 2014 where Adobe CISO or CIO or someone pretty much said that they don’t give fucks about product security. E.g. zero impact on sales. I suspect it was thrown in as a bit of trolling attempt in a conversation but looking at their track record maybe that is the reality.

> they don’t give fucks about product security.

More accurately stated as "we sandboxed it, so anything discovered is less likely to be critical." https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/sa...

I've heard a variant of that talk delivered by a non-C-level at an appsec/prodsec-focused conference where the rehashed quote above (though I'm blatantly paraphrasing) was the justification used. Something more closely reflecting the truth might be "we can't realistically tackle the many security defects in Acrobat and Flash, so we sandboxed both applications instead to generally reduce the technical risks posed by any vulnerabilities in code."

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#30

Post by devwastaken »

saagarjha wrote: post #27
devwastaken wrote: post #26

It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.

PDFs are supposed to look the same on every computer. Webpages can’t do that yet.

I don't know how accurate that is for PDF's, but webpages are supposed to look the same, and given known compatible styling, it should be on any modern browser. Browsers are extremely consistent in content presentation, that's why webpages from early 2000s still look the same.
Post reply on HN