NIST Site Search
Search NIST.GOV
Custom Search
[Official NIST.GOV TIME]
Product Research

Advertise on this site
Acrobat Reader Browser Plug-in has a huge XSS vulnerability.
Let's get straight to the point, this vulnerability should not be taken lightly. People I know, and in some cases fear, are worried about this. If you have the Adobe Acrobat Reader browser plug-in installed nearly any website that contains a PDF file can now be exploited for Cross-site Scripting (XSS). (UPDATES below)No Longer Supported
The bottom line? If yourlocalbank.com hosts a PDF file (and most do) and you have the Acrobat Reader browser plug-in installed (and a lot of people do) and you click on a specially crafted link to the yourlocalbank.com PDF file then someone can steal your login credentials and take care of your online banking for you. Or the bad guy can create fake pages for phishing attacks that appear to be from legitimate sites and collect credit card information that way (for more information see our XSS article). CNET gives a couple of good attack scenarios.

How? Its actually a very easy vulnerability to exploit and hackers everywhere are kicking themselves for not finding it sooner. Normally we don't post "how to" information but this is being posted everywhere and needs no complicated explanation. Simply append the Javascript to the end of the PDF as such:
  • http://somedomain.com/pdffile.pdf#blah=javascript:alert(“XSS”);

The Javascript can be anything and we've already seen malicious examples, including examples that can run executables. Here are some harmless examples from Dischant.ch:

Mitigation? Until Adobe releases an update the choices aren't very nice. Either uninstall the Acrobat Reader or use Firefox and use the NoScript plugin (see our instructions).

UPDATES:
  • There are reports that the latest Acrobat Reader 8.0 patch may have fixed the problem. Adobe was notified of the issue in advance of public release of the vulnerability. You can download the latest version from Adobe.
  • 1/4/2007 - Because of the way Internet Explorer interfaces with the Acrobat Reader it apparently does not run the JavaScript correctly. IE7 apparently displays a network error and won't display the PDF or run the JavaScript, IE6 seems to simply ignore JavaScript completely. Firefox and Opera are attack vectors and users of these browsers should take precautions (ie; in Firefox use the NoScript plugin).
  • 1/4/2007 - Webmasters can prevent PDF files hosted on their systems from being used in XSS attacks by changing the MIME-type of the PDF extension to something non-existent. This will force the web browser to prompt the user to download the PDF file rather than view it within the browser. This will prevent your site from being used in phishing schemes, session hijacking, password theft, etc. Most people simply do not update their 3rd party applications so this might be best way to handle the issue. Financial institutions should definitely consider doing this.


As we've said before everyone needs to get a lot better at updating 3rd party applications, not just the OS and the web browser. A lot of people have plugins installed such as the Acrobat Reader, Flash, Quicktime, etc. All of these can have nasty vulnerabilities.

Quotes:
This is really sort of insane. Like you said, it’s simple, but nasty. Now its not really a question of ‘where’s the useful XSS vuln on target site?’ its more ‘oh hey they’ve got a PDF file… now just how do I want to use this againt them?’. This opens so many doors to exploitation, it’s not really even funny… Drive-by credential theft is the one that comes to mind first…
--- comment at ha.ckers.org



Share or Bookmark this Article Using:
| furl | reddit | del.icio.us | magnoliacom | digg | newsvine | stumble it |



Google
WebNIST.org
NIST.govSecurityFocus.com





Posted by NIST.org on Wednesday 03 January 2007 - 20:31:17 | |printer friendly
Translate to: French German Italian Spanish Portuguese GTM_LAN_DUTCH Russian Chinese Arabic Korean English
Google Ads




Headlines

»NCCoE Speaker Series March 2015
»New NIST Tools to Help Boost Wireless Channel Frequencies and Capacity
»NIST Announces Pilot Grants Competition to Improve Security and Privacy of Online Identity Verification Systems
»Vendors Sought to Develop Model System to Monitor Security of Energy Industry Networked Control Systems
»NIST Releases Update of Industrial Control Systems Security Guide for Final Public Review
»Cybersecurity Summit Technical Workshop
»NIST Forensic Science Standards Committees to Hold First Public Meetings in February 2015
»NIST Security Guide Walks Organizations Through the Mobile App Security Vetting Process
»Open-Source Software for Quantum Information
»NIST Requests Round Two Comments on its Cryptographic Standards Process
»Symposium to Focus on Future of Voting Systems
»NIST Meeting: Cybersecurity Is a Key Ingredient In the Manufacturing Mix
»Future of Voting Systems Symposium II
»Global City Teams Challenge Tech Jam
»NIST Announces Initial Members of Forensic Science Digital Evidence Subcommittee


Date published: not known
Details

»Cisco IPv6 Denial of Service Vulnerability
Original release date: February 25, 2015 Cisco has identified a vulnerability that could allo ...
»Samba Remote Code Execution Vulnerability
Original release date: February 24, 2015 Linux and Unix based operating systems employing Sam ...
»Mozilla Releases Security Updates for Firefox, Firefox ESR, and Thunderbird
Original release date: February 24, 2015 The Mozilla Foundation has released security updates ...
»Lenovo Computers Vulnerable to HTTPS Spoofing
Original release date: February 20, 2015 Lenovo consumer personal computers employing the pre ...
»IRS Issues Warning for a Scam Targeting Tax Preparers
Original release date: February 18, 2015 The Internal Revenue Service (IRS) has issued a pres ...
»ISC Releases Security Updates for BIND
Original release date: February 18, 2015 The Internet Systems Consortium (ISC) has released s ...
»Microsoft Releases February 2015 Security Bulletin
Original release date: February 10, 2015 Microsoft has released updates to address vulnerabil ...
»Microsoft Releases Critical Security Update for Internet Explorer
Original release date: February 10, 2015 Microsoft has released a critical security update to ...
»Google Releases Security Update for Chrome OS
Original release date: February 10, 2015 Google has released Chrome OS 40.0.2214.114 for Chro ...
»Microsoft Releases Critical Security Bulletin
Original release date: February 10, 2015 Microsoft has released Security Bulletin MS15-011 to ...


Date published: not known
Details

»Paper: Script in a lossy stream
Dénes Óvári explains how to store code in lossily compressed JPEG data. Malformed PDF ...
»TorrentLocker spam has DMARC enabled
Use of email authentication technique unlikely to bring any advantage. Last week, Trend Micro resear ...
»VB2014 paper: Caphaw - the advanced persistent pluginer
Micky Pun and Neo Tan analyse the banking trojan that is best known for spreading through Skype. Sin ...
»M3AAWG releases BCP document on dealing with child sexual abuse material
Subject may make many feel uncomfortable, but it is essential that we know how to deal with it. The ...
»Hacker group takes over Lenovo's DNS
As emails were sent to wrong servers, DNSSEC might be worth looking into. Although, after some initi ...
»Coordinated action takes down Ramnit botnet infrastructure
Malware remains present on infected machines; 2012 Virus Bulletin paper worth studying. A coordinate ...
»Almost 50% increase in reported vulnerabilities as non-Windows operating systems lead the table
Each discovered vulnerability is actually a good news story. Last week, security firm GFI published ...
»Vawtrak trojan spread through malicious Office macros
Users easily tricked, but plenty of opportunity for the malware to be blocked. Researchers at Trend ...
»Lenovo laptops pre-installed with software that adds its own root CA certificate
Shared root certificate makes for easy man-in-the-middle attacks. What is Superfish? Superfish is a ...


Date published: not known
Details

»5 Signs That The Firewall's Not Dead Yet
Demise of firewall is a long way off, according to recent survey results.
»No Silver Bullets for Security
A quick-fix security solution for cyberphysical systems doesn't exist.
»Why Security Awareness Alone Won't Stop Hackers
End-user training is a noble pursuit but it's no defense against "low and slow" attacks that take mo ...
»Dark Reading Offers Cyber Security Crash Course At Interop 2015
New event is designed to provide fast education on the latest threats and defenses
»Mobile Security By The Numbers
Rounding up the latest research on mobile malware and security practices.
»Eyes On The Analytics Prize
»Cyber Intelligence: Defining What You Know
Too often management settles for security data about things that are assumed rather than things you ...
»Black Hat USA 2015: Never Too Early - Web App Security
We admit: Given that this is February, August's Black Hat USA 2015 still feels quite a ways off... a ...
»Hits Keep On Coming For Both SSL & Its Abusers
Hacktivist group Lizard Squad punishes Lenovo with a DNS hijack. Will Comodo be next?


Date published: Mon, 02 Mar 2015 13:51:32 EST
Details
Main Menu
· Home
Current Security News
 
SANS Internet Storm Center, InfoCON: green

» Infocon: green

» How Do You Control the Internet of Things Inside Your Network?, (Mon, Mar 2nd)
[02 Mar 2015 10:21am]

» ISC StormCast for Monday, March 2nd 2015 http://isc.sans.edu/podcastdetail.html?id=4377, (Mon, Mar 2nd)
[01 Mar 2015 06:57pm]

» Advisory: Seagate NAS Remote Code Execution, (Sun, Mar 1st)
[01 Mar 2015 09:14am]

» Let's Encrypt!, (Fri, Feb 27th)
[27 Feb 2015 08:34pm]

» DDOS are way down? Why?, (Fri, Feb 27th)
[27 Feb 2015 01:04pm]

» Leonard Nimoy has passed - please be alert for the rounds of Phishing and malware that will inevitably occur!, (Fri, Feb 27th)
[27 Feb 2015 11:23am]

» Tails 1.3 released - https://tails.boum.org/news/version_1.3/index.en.html, (Fri, Feb 27th)
[27 Feb 2015 06:30am]

» Tor Browser Version 4.0.4 released - https://blog.torproject.org/blog/tor-browser-404-released, (Fri, Feb 27th)
[27 Feb 2015 06:27am]

» ISC StormCast for Friday, February 27th 2015 http://isc.sans.edu/podcastdetail.html?id=4375, (Fri, Feb 27th)
[26 Feb 2015 06:42pm]

» New Feature: Subnet Report, (Thu, Feb 26th)
[26 Feb 2015 11:17am]

***
CNET News.com

» Microsoft defends opening Hotmail account of blogger in espionage case
[20 Mar 2014 06:47pm]

» Syria's Internet goes dark for several hours
[20 Mar 2014 04:25pm]

» Symantec fires CEO Steve Bennett
[20 Mar 2014 03:07pm]

» Microsoft sniffed blogger's Hotmail account to trace leak
[20 Mar 2014 01:28pm]

» Microsoft sniffed private Hotmail account to trace trade secret leak
[20 Mar 2014 01:28pm]

» IBM's new services zero in on fraud, financial crime
[20 Mar 2014 07:31am]

» Despite assault on privacy, Page sees value in online openness
[19 Mar 2014 08:00pm]

» Hackers transform EA Web page into Apple ID phishing scheme
[19 Mar 2014 05:21pm]

» NSA top lawyer says tech giants knew about data collection
[19 Mar 2014 02:57pm]

» Microsoft touts study showing the cost of pirated software
[19 Mar 2014 06:55am]

» Microsoft touts study showing cost of malware in pirated software
[19 Mar 2014 06:55am]

» How to spy on your lover, the smartphone way
[18 Mar 2014 01:24pm]

» Mt. Gox update lets users see their Bitcoin balances
[18 Mar 2014 06:38am]

» Fake Malaysia Airlines links spread malware
[17 Mar 2014 05:12pm]

» IBM: No, we did not help NSA spy on customers
[17 Mar 2014 01:15pm]

***

***



***


More IT Security
News Feeds
More Sponsors

Advertise on this site
RSS Feeds
Our news can be syndicated by using these rss feeds.
rss1.0
rss2.0
rdf
Symantec News

NIST.org is in no way connected to the U.S. government site NIST.gov

This site is © John Herron, CISSP. All Rights Reserved.

Please visit daily to stay up to date on all your IT Security compliance issues.

http://www.nist.org -
Hosted by BlueHost. We've never had a better hosting company.
{THEMEDISCLAIMER}