Friday, August 17, 2007
Is malicious PDF a danger?
Adobe has said that PDF documents attached to spam pose no security risk. Adobe certainly would like this to be true, but any such claim needs to be examined with skepticism.
The PDF spec includes a "Launch" action which can be triggered by clicking on something harmless-looking, or just by moving to a page. Parameters can be provided to the application, giving the launching document a lot of flexibility. A spam mail which contains two attachments, a PDF document and an EXE file which it launches, could be a deadly combination.
In addition, arbitrary media types can be embedded in a PDF file. These will be played (to use Adobe's generic term) only if the PDF reader supports them, but vulnerabilities in standard libraries for any of these media can become vulnerabilities in PDF.
The standard advice is the right advice: Don't open attachments from untrusted sources.
Discussion of some risks in PDF is available here. The claim that disabling JavaScript in the PDF reader prevents launch actions is not correct; launch actions can be used without JavaScript.
Labels: PDF
