NIST Site Search
Search NIST.GOV
Custom Search
[Official NIST.GOV TIME]
Product Research

Advertise on this site
Acrobat Reader Browser Plug-in has a huge XSS vulnerability.
Let's get straight to the point, this vulnerability should not be taken lightly. People I know, and in some cases fear, are worried about this. If you have the Adobe Acrobat Reader browser plug-in installed nearly any website that contains a PDF file can now be exploited for Cross-site Scripting (XSS). (UPDATES below)No Longer Supported
The bottom line? If yourlocalbank.com hosts a PDF file (and most do) and you have the Acrobat Reader browser plug-in installed (and a lot of people do) and you click on a specially crafted link to the yourlocalbank.com PDF file then someone can steal your login credentials and take care of your online banking for you. Or the bad guy can create fake pages for phishing attacks that appear to be from legitimate sites and collect credit card information that way (for more information see our XSS article). CNET gives a couple of good attack scenarios.

How? Its actually a very easy vulnerability to exploit and hackers everywhere are kicking themselves for not finding it sooner. Normally we don't post "how to" information but this is being posted everywhere and needs no complicated explanation. Simply append the Javascript to the end of the PDF as such:
  • http://somedomain.com/pdffile.pdf#blah=javascript:alert(“XSS”);

The Javascript can be anything and we've already seen malicious examples, including examples that can run executables. Here are some harmless examples from Dischant.ch:

Mitigation? Until Adobe releases an update the choices aren't very nice. Either uninstall the Acrobat Reader or use Firefox and use the NoScript plugin (see our instructions).

UPDATES:
  • There are reports that the latest Acrobat Reader 8.0 patch may have fixed the problem. Adobe was notified of the issue in advance of public release of the vulnerability. You can download the latest version from Adobe.
  • 1/4/2007 - Because of the way Internet Explorer interfaces with the Acrobat Reader it apparently does not run the JavaScript correctly. IE7 apparently displays a network error and won't display the PDF or run the JavaScript, IE6 seems to simply ignore JavaScript completely. Firefox and Opera are attack vectors and users of these browsers should take precautions (ie; in Firefox use the NoScript plugin).
  • 1/4/2007 - Webmasters can prevent PDF files hosted on their systems from being used in XSS attacks by changing the MIME-type of the PDF extension to something non-existent. This will force the web browser to prompt the user to download the PDF file rather than view it within the browser. This will prevent your site from being used in phishing schemes, session hijacking, password theft, etc. Most people simply do not update their 3rd party applications so this might be best way to handle the issue. Financial institutions should definitely consider doing this.


As we've said before everyone needs to get a lot better at updating 3rd party applications, not just the OS and the web browser. A lot of people have plugins installed such as the Acrobat Reader, Flash, Quicktime, etc. All of these can have nasty vulnerabilities.

Quotes:
This is really sort of insane. Like you said, it’s simple, but nasty. Now its not really a question of ‘where’s the useful XSS vuln on target site?’ its more ‘oh hey they’ve got a PDF file… now just how do I want to use this againt them?’. This opens so many doors to exploitation, it’s not really even funny… Drive-by credential theft is the one that comes to mind first…
--- comment at ha.ckers.org



Share or Bookmark this Article Using:
| furl | reddit | del.icio.us | magnoliacom | digg | newsvine | stumble it |



Google
WebNIST.org
NIST.govSecurityFocus.com





Posted by NIST.org on Wednesday 03 January 2007 - 20:31:17 | |printer friendly
Translate to: French German Italian Spanish Portuguese GTM_LAN_DUTCH Russian Chinese Arabic Korean English
Google Ads




Headlines

»CVE-2013-4312
The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial ...
»CVE-2014-9757
The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.
»CVE-2015-2012
The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8 ...
»CVE-2015-3251
Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive p ...
»CVE-2015-3252
Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual m ...
»CVE-2015-6398
Cisco Nexus 9000 Application Centric Infrastructure (ACI) Mode switches with software before 11.0(1c ...
»CVE-2015-7513
arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state ...
»CVE-2015-7550
The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not pro ...
»CVE-2015-7566
The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows ph ...
»CVE-2015-7914
Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication by ...
»CVE-2015-7915
Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows remote att ...
»CVE-2015-7916
Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows r ...
»CVE-2015-8360
An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote atta ...
»CVE-2015-8361
Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not requi ...
»CVE-2015-8539
The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a d ...


Date published: 2016-02-10T05:50:00Z
Details

»Microsoft Releases February 2016 Security Bulletin
Original release date: February 09, 2016 Microsoft has released 13 updates to address vulnera ...
»Google Releases Security Update for Chrome
Original release date: February 09, 2016 Google has released Chrome version 48.0.2564.109 to ...
»Adobe Releases Security Updates
Original release date: February 09, 2016 Adobe has released security updates to address vulne ...
»Oracle Releases Security Updates for Java
Original release date: February 08, 2016 Oracle has released security updates to address a vu ...
»Comodo Chromodo Browsers Vulnerable to Cross-Domain Attacks
Original release date: February 04, 2016 Some Comodo Chromodo browser versions (45.8.12.392, ...
»WordPress Releases Security Update
Original release date: February 02, 2016 WordPress 4.4.1 and prior versions contain two secur ...
»FTC Announces Enhancements to IdentityTheft.gov
Original release date: January 29, 2016 The Federal Trade Commission (FTC) has upgraded its I ...
»OpenSSL Releases Security Advisory
Original release date: January 28, 2016 OpenSSL versions 1.0.2f and 1.0.1r have been released ...
»Cisco Releases Security Update
Original release date: January 27, 2016 Cisco has released a security update to address a vul ...
»Mozilla Releases Security Updates
Original release date: January 26, 2016 Mozilla has released security updates to address mult ...


Date published: not known
Details

»Welcome to virusbulletin.com
Almost 20 years after Virus Bulletin revealed its first site on the "world wide web", we've redesign ...
»VB2015 video: TurlaSat: The Fault in our Stars
In a presentation at VB2015 in Prague, Kaspersky Lab researcher Kurt Baumgartner talked about Turla' ...
»Security vendors should embrace those hunting bugs in their products
When interviewed by the Risky Business podcast last week, VB Editor Martijn Grooten talked about the ...
»More VB Conference papers and videos published
More VB2014 Conference papers and videos published - 11 papers and 9 videos added to our website....
»Throwback Thursday: Peter-II - Three Questions of The Sphinx
This Throwback Thursday, VB heads back to 1993, when an ordinary memory-resident master boot sector ...
»VB2015 paper: Effectively testing APT defences
Simon Edwards discusses how to test the potentially untestable....
»VB2015 paper: The ethics and perils of APT research: an unexpected transition into intelligence brokerage
Juan Andrés Guerrero-Saade discusses the perils and ethical conundrums that arise as the industry en ...
»VB2015 paper: Digital 'Bian Lian' (face changing): the Skeleton Key malware
Microsoft, Dell SecureWorks researchers analyse malware targeting Active Directory servers....
»Throwback Thursday: I say Virus, You say Trojan
This Throwback Thursday, VB heads back to 1998 — a time when anti-virus vendors avoided tackling non ...


Date published: not known
Details
Main Menu
· Home
Current Security News
 
US-CERT Current Activity

» Microsoft Releases February 2016 Security Bulletin
[09 Feb 2016 03:44pm]

» Google Releases Security Update for Chrome
[09 Feb 2016 03:18pm]

» Adobe Releases Security Updates
[09 Feb 2016 11:01am]

» Oracle Releases Security Updates for Java
[08 Feb 2016 02:20pm]

» Comodo Chromodo Browsers Vulnerable to Cross-Domain Attacks
[04 Feb 2016 05:53pm]

» WordPress Releases Security Update
[02 Feb 2016 02:46pm]

» FTC Announces Enhancements to IdentityTheft.gov
[29 Jan 2016 03:36pm]

» OpenSSL Releases Security Advisory
[28 Jan 2016 02:11pm]

» Cisco Releases Security Update
[27 Jan 2016 03:40pm]

» Mozilla Releases Security Updates
[26 Jan 2016 02:56pm]

***
US-CERT Alerts

» TA15-337A: Dorkbot
[03 Dec 2015 04:40pm]

» TA15-314A: Compromised Web Servers and Web Shells - Threat Awareness and Guidance
[10 Nov 2015 06:12pm]

» TA15-286A: Dridex P2P Malware
[13 Oct 2015 05:23am]

» TA15-240A: Controlling Outbound DNS Access
[28 Aug 2015 11:31am]

» TA15-213A: Recent Email Phishing Campaigns – Mitigation and Response Recommendations
[01 Aug 2015 04:01pm]

» TA15-195A: Adobe Flash and Microsoft Windows Vulnerabilities
[14 Jul 2015 05:13pm]

» TA15-120A: Securing End-to-End Communications
[29 Apr 2015 10:00pm]

» TA15-119A: Top 30 Targeted High Risk Vulnerabilities
[28 Apr 2015 10:00pm]

» TA15-105A: Simda Botnet
[15 Apr 2015 06:51am]

» TA15-103A: DNS Zone Transfer AXFR Requests May Leak Domain Information
[13 Apr 2015 01:36pm]

***
Computerworld Security

» Microsoft fixes 36 flaws in IE, Edge, Office, Windows, .NET Framework
[10 Feb 2016 08:34am]

» Government may tap into your IoT gadgets and use your smart devices to spy on you
[10 Feb 2016 08:20am]

» Poseidon hacker group behind long-running extortion scheme
[10 Feb 2016 06:04am]

» Setting up a Windows 10 picture PIN
[10 Feb 2016 06:00am]

» U.S. regulator: A Google computer could qualify as car driver
[10 Feb 2016 05:51am]

» Google will stop accepting new Flash ads on June 30
[10 Feb 2016 05:18am]

» Identity thieves obtain 100,000 electronic filing PINs from IRS system
[10 Feb 2016 05:13am]

» IDG Contributor Network: Microsoft delivers major updates to Internet Explorer and Adobe Flash Player
[10 Feb 2016 04:54am]

» Google drives email users to up their Gmail security and privacy
[10 Feb 2016 04:15am]

» FBI Director entreats tech firms to release encrypted data used in crimes and terror
[09 Feb 2016 03:32pm]

» Twitter gets an assist in taking on trolls and bullies
[09 Feb 2016 12:30pm]

» Google adds warning to unencrypted emails
[09 Feb 2016 11:36am]

» DoJ fiddles while FBI & DHS burn (after trivial hack of U.S. employee data)
[09 Feb 2016 04:51am]

» U.S. government wants to sharply increase spending on cybersecurity
[09 Feb 2016 04:24am]

» Kingston buys encrypted flash drive maker IronKey
[08 Feb 2016 02:19pm]

***
Microsoft Security Advisories

» 3137909 - Vulnerabilities in ASP.NET Templates Could Allow Tampering - Version: 1.0
[09 Feb 2016 12:00am]

» 2871997 - Update to Improve Credentials Protection and Management - Version: 5.0
[09 Feb 2016 12:00am]

» 3123479 - Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program - Version: 1.0
[12 Jan 2016 12:00am]

» 3109853 - Update to Improve TLS Session Resumption Interoperability - Version: 1.0
[12 Jan 2016 12:00am]

» 3118753 - Updates for ActiveX Kill Bits 3118753 - Version: 1.0
[12 Jan 2016 12:00am]

» 2755801 - Update for Vulnerabilities in Adobe Flash Player in Internet Explorer and Microsoft Edge - Version: 53.0
[05 Jan 2016 12:00am]

» 3123040 - Inadvertently Disclosed Digital Certificate Could Allow Spoofing - Version: 1.0
[08 Dec 2015 12:00am]

» 3057154 - Update to Harden Use of DES Encryption - Version: 1.1
[08 Dec 2015 12:00am]

» 3119884 - Inadvertently Disclosed Digital Certificates Could Allow Spoofing - Version: 1.0
[30 Nov 2015 12:00am]

» 3108638 - Update for Windows Hyper-V to Address CPU Weakness - Version: 1.0
[10 Nov 2015 12:00am]

» 3097966 - Inadvertently Disclosed Digital Certificates Could Allow Spoofing - Version: 2.0
[13 Oct 2015 01:00am]

» 2960358 - Update for Disabling RC4 in .NET TLS - Version: 2.0
[13 Oct 2015 01:00am]

» 3042058 - Update to Default Cipher Suite Priority Order - Version: 1.1
[13 Oct 2015 01:00am]

» 3083992 - Update to Improve AppLocker Publisher Rule Enforcement - Version: 1.0
[08 Sep 2015 01:00am]

» 3074162 - Vulnerability in Microsoft Malicious Software Removal Tool Could Allow Elevation of Privilege - Version: 1.0
[14 Jul 2015 01:00am]

***
WIRED » Security

» Obama’s Cybersecurity Plan is Meant to Secure His Legacy
[10 Feb 2016 05:00am]

» How to Hack the Power Grid Through Home Air Conditioners
[09 Feb 2016 08:40am]

» Donate Your Old USB Drives to Fight North Korean Brainwashing
[09 Feb 2016 07:00am]

» Obama’s New Cybersecurity Plan Sticks to the Most Basic Basics
[09 Feb 2016 03:01am]

» Hack Brief: Hacker Leaks the Info of Thousands of FBI and DHS Employees
[08 Feb 2016 01:33pm]

» It’s Been 20 Years Since This Man Declared Cyberspace Independence
[08 Feb 2016 07:58am]

» Take a Trip to a Time When Viruses Still Called You Names
[08 Feb 2016 05:00am]

» Security News This Week: The White House Bans Its Own Security Researcher
[06 Feb 2016 05:00am]

» Julian Assange’s 3.5-Year Detainment in Embassy Ruled Unlawful
[05 Feb 2016 01:27am]

» Snowden’s Chronicler Reveals Her Own Life Under Surveillance
[04 Feb 2016 07:03am]

***
Network World Security

» IDG Contributor Network: Drugs, guns, and hitmen more common on dark web than religious extremism
[10 Feb 2016 09:41am]

» SAP slaps patch on leaky factory software
[10 Feb 2016 09:06am]

» Let’s encrypt – but let’s also decrypt and inspect SSL traffic for threats
[10 Feb 2016 08:33am]

» Microsoft fixes 36 flaws in IE, Edge, Office, Windows, .NET Framework
[10 Feb 2016 06:52am]

» REVIEW: Cyphort makes advanced threat protection easier than ever
[25 Jan 2016 04:00am]

» Two network video cameras raise the bar for home security
[19 Jan 2016 12:20pm]

» FidSafe: A cloud service for important documents (and the price is right)
[15 Jan 2016 06:23pm]

» Best open source email security products
[11 Jan 2016 04:00am]

» REVIEW: MailScanner and ScrolloutF1 are standouts in open source email security
[11 Jan 2016 04:00am]

» Piper nv: An ambitious home monitoring and automation system
[09 Jan 2016 04:09pm]

» Sentri wants to guard your home but isn't very good at it yet
[20 Dec 2015 04:11pm]

» Dog and Bone LockSmart: The padlock rethought
[19 Dec 2015 12:53pm]

» Review: Best password managers for the enterprise
[07 Dec 2015 04:00am]

» SAP slaps patch on leaky factory software
[10 Feb 2016 09:06am]

» Microsoft fixes 36 flaws in IE, Edge, Office, Windows, .NET Framework
[10 Feb 2016 06:52am]

***


More IT Security
News Feeds
More Sponsors

Advertise on this site
RSS Feeds
Our news can be syndicated by using these rss feeds.
rss1.0
rss2.0
rdf
Symantec News

NIST.org is in no way connected to the U.S. government site NIST.gov

This site is © John Herron, CISSP. All Rights Reserved.

Please visit daily to stay up to date on all your IT Security compliance issues.

http://www.nist.org -
Hosted by BlueHost. We've never had a better hosting company.
{THEMEDISCLAIMER}