Security

Adobe Alert: Sure enough, another vulnerability

I doubt if everyone has installed the patch for Adobe's February zero-day vulnerability and now there's another one just waiting to get exploited. Find out what I decided to do.

Adobe Reader and Acrobat once again have a JavaScript vulnerability. The following quote is from Adobe's Product Security Incidence Response Team (PSIRT) blog dated 27 April 2009:

"All currently supported shipping versions of Adobe Reader and Acrobat (Adobe Reader and Acrobat 9.1, 8.1.4, and 7.1.1 and earlier versions) are vulnerable to this issue. Adobe plans to provide updates for all affected versions for all platforms (Windows, Macintosh and Unix) to resolve this issue. We are working on a development schedule for these updates and will post a timeline as soon as possible. We are currently not aware of any reports of exploits in the wild for this issue."

Adobe's attempt at a solution is to recommend disabling JavaScript until they can figure it out:

  1. Launch Acrobat or Adobe Reader
  2. Select Edit>Preferences
  3. Select the JavaScript Category
  4. Uncheck the ‘Enable Acrobat JavaScript' option
  5. Click OK

Not good

I must admit that I've been a staunch supporter of Adobe products for many years. Now, I'm starting to question that loyalty as it's affecting me personally along with what I tell my clients. It's especially frustrating, being Adobe's second major vulnerability in the past three months. I explained the first vulnerability in my article "Adobe Alert: Updates available for latest zero-day exploit"

I even took my own advice to heart and updated my client's workstations to Adobe Reader 9.0 as soon as I heard about the February exploit. Now, I have to go and tell them that even after updating, Adobe Reader and Acrobat are still vulnerable. That's not going to be something my clients want to hear.

Changing course

I began a quest last week, determined to find a replacement for Adobe Reader. I had no idea there were so many free PDF readers to choose from. After reading way too many evaluations, I narrowed the myriad of choices down to three, Foxit Reader, Sumatra PDF, and PDF-XChange Viewer.

Then came testing and talking to the experts (you know, the actual users). Foxit Reader won hands down and will be what I recommend to my clients as a replacement for Adobe Reader. The application is lightweight, more responsive and the developers have a history of quickly repairing product vulnerabilities.

Acrobat is a different story

Next I started looking for an adequate replacement for Adobe Acrobat. Truth be told, I'm not  having much success. The user experts keep reminding me that my suggestions don't have the same features inherent to Acrobat and they aren't going to accept anything less.

One feature they prize and is absent in most other PDF creating applications is Adobe's Combine Files wizard. It allows you to merge multiple PDF files into a single PDF document or a PDF package. I have to admit that I'd be lost without that capability myself. So now what? Let's review what I'm facing and need to resolve:

  • Adobe Acrobat is just as vulnerable as Reader.
  • Replacing Acrobat would require an application with equivalent features.
  • Even if found, replacing something that works would be a tough sell monetarily.
  • Disabling JavaScript is not an option.
Temporary solution

I'm sure Adobe will come out with a fix, but when? History has already proven that the bad guys beat Adobe to the punch, creating zero-day exploits long before patches come out. Knowing that, along with clients wondering if I had a clue gave me enough incentive to figure out a workable solution.

I decided to install Foxit Reader on all the workstations, even those using Acrobat. Then explain to everyone that they need to use Foxit Reader for viewing PDF files, at least until Adobe rolls out the fix for the current vulnerability. Getting everyone's blessing was easier than I thought. It just so happens that Foxit Reader opens PDF files a lot faster that either Adobe Reader or Acrobat.

Even so, I thought I'd increase the safety margin by configuring Foxit Reader to have priority when opening PDF files. That option is offered during installation, or can be changed afterwards by opening Foxit Reader, clicking on the help button, and checking "Set to Default PDF Reader".

Final thoughts

My Acrobat fix is far from being a perfect solution. So I'm hoping Adobe will get the patches released quickly. I'm still looking for a replacement for Acrobat too. Foxit comes close, but you have to buy three independent applications Creator, Editor, and Organizer. If you have something that works, I'd appreciate hearing about it.

About

Information is my field...Writing is my passion...Coupling the two is my mission.

64 comments
jeferris
jeferris

I found this years ago through SourceForge. It acts as a Printer interface to let you 'print' ANY document into a pdf. So while it doesn't do 'merge', that kind of capability is available in Word... so I build my desired file up in Word and 'print' it as a pdf.

Michael Kassner
Michael Kassner

I finally found the link again that explains how Adobe makes a package instead of merging several PDF files into one large one. http://www.acrobatusers.com/articles/2006/10/pdf_creation_features

curtis.hudson
curtis.hudson

Let's say I want to combine page 1 of a Word document, 2 e-mail messages, and 1 sheet of a 5 sheet Excel workbook into a PDF. PDF Redirect will queue all printable selections via a phantom printer driver into 1 PDF file, with full text searching capabilities (Not indexed). The printable selections can also be resequenced as necessary before final PDF creation. The only area in which I'm a bit fuzzy are digital signatures on the sub-documents of the final PDF. It sounds like it might cover most of the positive aspects of the Adobe "Package", and it's free! There is also a paid version which adds additional features. Take a look at http://www.exp-systems.com for a preview. Best regards, Curtis

Michael Kassner
Michael Kassner

That's not what I'm looking for. Most PDF applications will handle that. Check out the link in my last comment. It's becoming apparent that Adobe is the only company that is doing the packaging at this time.

Michael Kassner
Michael Kassner

That you are correct. I'm sure that if more people were aware of it, they would be using it. I stumbled onto it accidentally and now use it all the time.

Dogcatcher
Dogcatcher

If you need the PDF packager, then it looks like you are stuck with Acrobat for now. However, if the feature proves useful to a lot of people, then it is a safe bet that some of the open source vendors will incorporate it into their applications.

johan.vanbrabant
johan.vanbrabant

After a problem with Adobe, I switched to JawsDF suite: http://www.jawspdf.com/. For just reading a PDF file, I use Foxit, but for editing PDF files, I use JawsPDF Editor. When using a PDF printer like CutePDF, you do not need to buy/use the JawsPDFcreator. Although Jaws works fine with XP, sometimes problems occur with Vista after a new Vista update has been installed. Then I just rerun a small file procured by Jaws to reset the registry values.

misiaczku2008-techrep
misiaczku2008-techrep

Yes, I have been using foxit for ages. Not so much of a lumbering dinosaur as adobe (footpring and speed) Have also recently started using PDF experte seems to do everything

Eric.Jablow
Eric.Jablow

You and your customers could always go low-tech, and try pdfTeX. It has the advantage of working with plain ASCII files; it has the disadvantage of having a steep learning curve.

andreherter
andreherter

For combining pdf-files I just use pdfedit995. Kind regards, Andreas

fkowal
fkowal

Ok, I havent read all the post but based on the "titles" of the post, Haven't any of you hear of NITRO PDF? http://www.nitropdf.com/index.asp Start Subscribing to http://www.planetpdf.com NO I have not used it yet, I just happen to know about it.

daniel.humber
daniel.humber

We use Nitro PDF Professional for most of our users who need to create PDFs it has a very easy to use "Combine files" function that will combine whichever files you have open quickly and easily.

Scott Bates
Scott Bates

I've been using Nitro PDF as a 30 day trial and it works well for what I want it to do. I haven't tried all the features but it does have a combiner for docs/pdf's and the pdf to word function works great - not to mention it's a heck of a lot cheaper. there is a free 30 day trial - I'm in day 26 - and for the price ($99)it beats the heck out of Acrobat - there are 3 versions - the free one will even convert PDF's to RTF according to the propaganda.... Everyone uses software differently so if you can't beat it up in 30 days it may work for you...

rasilon
rasilon

There is a free alternative to merging PDF files. It's called "pdfmerge" and it's from Sourceforge.net. Very basic (Merge & Split), but it works... http://sourceforge.net/projects/pdfmerge/ Hank Arnold (MVP)

Michael Kassner
Michael Kassner

Merge isn't what I'm looking for. Most alternatives to Acrobat do that. Creating a package with each PDF file intact inside a PDF is what I'm looking for.

Dogcatcher
Dogcatcher

It is not obvious to this reader why you would need a PDF wrapper for PDF files, but if you do, then you may be stuck with the price and problems of the one application that meets your needs. There are a couple functionally-similar alternatives you may have considered: 1. Wrap the PDFs in a self-extracting ZIP file, or 2. Make the individual PDFs into something like chapters using the PDF bookmark feature. That's easy to do in the free Foxit Reader. Acrobat's efficiency in creating a PDF of PDFs may be so great that the time savings pay for the product. However, if the need is infrequent, then Adolix Split and Merge PDF plus Foxit Reader, or a ZIP file, may be a reasonable alternative.

Michael Kassner
Michael Kassner

The chapter idea is a thought, but not as convenient. An example of why I like packages is that I PDF each of my articles. Then I place each PDF file into a PDF package for the specific month. They are easy to refer to that way.

seanferd
seanferd

 

alan
alan

I use both PDF-XChange Viewer and PD Foxit Pro. The Foxit Pro costs money. I prefer PDF-XChange Viewer Portable because :- It is Free; Some documents are better / more accurately displayed - amongst the improvements are to "Goto page 345" is less likely to give me page 351 and the need to scroll up a bit; It has better text search capability; I can select part of the document and copy as text to paste into a text file (which Foxit Free totally prevented, and was the reason I bought Foxit Pro before I discovered PDF-XChange Viewer.)

Michael Kassner
Michael Kassner

On the first URL, there's a sponsor claiming: Adobe Acrobat 9.0 - Free Fast Download of Adobe Acrobat 9.0 Fast & Easy - 100% PDF Compatible. It doesn't bring you to Adobe. That's on Download.com too. Oh My.

rwtodd2007
rwtodd2007

We use Adobe reader on a daily basis, and since the pdf files we use are encrypted, we have created security files to load into reader. If you dont have the file, you cannot see or read the document. Is a similar feature available in Fox-IT? I agree it does load a lot faster and takes up less memory. If I can create a way to view encrypted documents, Im all for the change.

Michael Kassner
Michael Kassner

Think so. Darn, that's another feature that's important. I also found out that Foxit Reader will not open the Adobe PDF package files.

Aaron McV
Aaron McV

I use Foxit Reader as my PDF viewer. I have not found a replacement to Acrobat, mainly due to the proprietary PDF format that Adobe created. If the goal is to simply combine multiple PDF files into one single pdf, there is a great free solution called AccessPDF. It is a command-line tool, but it certainly does the trick... and it is free. http://www.accesspdf.com/pdftk/

Michael Kassner
Michael Kassner

I'm trying to find an application that keeps the individual PDF files and has the ability to place them in a package, it's a great feature.

casternj
casternj

what package are you using to manage software?

Michael Kassner
Michael Kassner

The largest client has 25 workstations. As for managing are you referring to applications like Secunia?

casternj
casternj

secunia is almost what Im thinking. I want a central point system like WSUS. I want a utility that can install/update/remove as directed remotely.

Michael Kassner
Michael Kassner

The closest I have is AD group policies for installing programs. It's cumbersome, so I just do it the hard way right now.

?vatar
?vatar

Hate to bring this up but, you are aware that Foxit has vulnerabilities also right? Look here: http://www.google.co.uk/search?hl=en&client=firefox-a&channel=s&rls=org.mozilla:en-US:official&hs=1XW&ei=_aX5Scwvg6W2B9-gvawD&sa=X&oi=spell&resnum=0&ct=result&cd=1&q=foxit+reader+vulnerability&spell=1 Nothing is sacred anymore.

Michael Kassner
Michael Kassner

Still the patch in a timely manner. I think Foxit had the patch for that exploit out within a day. Last February, it took Adobe 2 weeks to get a patch for a zero-day exploit. Foxit had a patch for that one out in a day as well. Not sure why the difference. It may be that Adobe is so big it can't react very fast.

bboyd
bboyd

Use and like both, also Open office has a import .PDF extension and and export drawing format to .pdf file option. Find all three better than an intrusive piece of adobe spyware.

Michael Kassner
Michael Kassner

Found anything that will aggregate pdf files into a container like Acrobat does?

bboyd
bboyd

Works ok, http://www.cutepdf.com/Products/CutePDF/Pro.asp "...Extract, Reorder and Duplicate pages Combine Multiple PDF Documents into one PDF File... " Maybe not quite what your used to but for my limited pdf use I found it easy. On machines that I didn't want to pay for an extra license I use OO Draw, but it handles acrobat .pdf files poorly in some cases. Common problem is that it will invert the image files. Otherwise its easy to use for page setup and layout.

Michael Kassner
Michael Kassner

I checked it out and it does make a single PDF file from multiple, but it doesn't do the package thing that Adobe does. I wish it did, though.

OurITLady
OurITLady

but there's a piece of software that the people I support love called Bluebeam, it has a batch creation feature at least. I haven't used it that much myself but the people I know who do prefer it to Adobe Acrobat (perhaps for the CAD functionality in the Revu edition). There's a trial download available on their website as well so you can check it out before purchase. Website is www.bluebeam.com

bilboatbath
bilboatbath

Than you for that, Michael. I've followed your lead.

Michael Kassner
Michael Kassner

It seems very fast. The only problem I have it that it doesn't read the PDF files where I have aggregated several individual PDF files.