Monday, September 18, 2006
PDF back doors
Here is a report of two PDF "back door" exploits.
The first exploit causes a specified URI to be launched when a document is opened. It appears that this is done simply by including a URI action (see Chapter 8 of the PDF specification, "URI Actions") in the PDF. It's thus very simple to have a PDF document cause the user's browser to open a URL which could contain malicious content, and the problem appears to be in the format specification, not in an Acrobat bug. The example linked to from the article opens a harmless URL.
"Back door" implies the use of an undocumented feature, so it isn't really a back door exploit, but a demonstration that a feature can be abused.
Labels: PDF
# posted by Gary McGath @ 1:00 PM 
