Adobe fixes critical Acrobat security flaw
updated 02:25 am EDT, Wed June 25, 2008
Adobe fixes Acrobat hole
Adobe on Monday released patches for Acrobat and its free Reader equivalent to fix a security hole that could leave Mac and Windows computers susceptible to control at the hands of a malicious remote user. Computerworld writes that the "critical" vulnerability has existed in several incarnations of the v8.x.x Acrobat software, but does not apply to users of Acrobat 7.1.0. The patch comes after criticism over Adobe's vague mention of vulnerability fixes in a recent update, as several past JavaScript bugs resurfaced, leaving many users affected.
"Adobe has an epidemic with regards to JavaScript," noted Andrew Storms, director of security operations at nCircle Network Security. "With this many JavaScript bugs in Acrobat, one begins to ask questions. Why would a full, thick application like Acrobat need to be using JavaScript, especially when JavaScript in the browser has historically been a target for hackers? And since JavaScript has been a target for so many years, why hasn't Adobe flushed out these vulnerabilities already?"
what's stupid is...
06/25, 03:02am reply
that Acrobat Reader is now over 100 Mb. Just to "read" PDFs. It used to be that it was decent, but now it's complete bloatware.
Guest
Fresh-Faced Recruit
Joined: Nov 1999
yeah!
06/25, 08:06am reply
The patch comes after criticism over Adobe's vague mention of vulnerability fixes in a recent update, as several past JavaScript bugs resurfaced, leaving many users affected.
They should take lessons from Apple and learn how to document their fixes!
And I didn't even know Adobe had support for javascript, nor any idea what in the world one would need it for. Is this like one of those lame-a** ideas from the 90's where email software makers added javascript support to email content because it would be 'cool'?
testudo
Fresh-Faced Recruit
Joined: Aug 2001
Alternatives
06/25, 08:53am reply
There's always Preview for basic PDF viewing, or another free alternative is Skim. (http://www.macupdate.com/info.php/id/24590/skim)
64stang06
Mac Elite
Joined: Aug 2007
Alternatives
06/25, 08:53am reply
There's always Preview for basic PDF viewing, or another free alternative is [url="http://www.macupdate.com/info.php/id/24590/skim"]Skim[/url]
(http://www.macupdate.com/info.php/id/24590/skim)
64stang06
Mac Elite
Joined: Aug 2007
Nevermind
06/25, 08:53am reply
I have horrible button clicking skills it seems.
64stang06
Mac Elite
Joined: Aug 2007
What, no LINK?
06/25, 09:35am reply
An article about a "critical vulnerability" and NO LINK for the patch.
How useful.
JeffHarris
Fresh-Faced Recruit
Joined: Oct 1999
re: Yeah (@ testudo)
06/25, 12:34pm reply
Adobe has Javascript support in all their applications. It was their solution to cross-platform application scripting and automation. In fact they use ECMA-262 which is a superset of Javascript.
Adobe uses the Qt development platform for building cross-platform applications (well probably until recently), and Qt comes with a pre-built Javascript compiler and stack for automation and application scripting. So they probably just incorporated that engine.
And Javascript is not as bad as it's made out to be. It's a very powerful language, and if implemented correctly, quite secure. Without Javascript, the web wouldn't exist.
shawnde
Fresh-Faced Recruit
Joined: Apr 2008