Reader PDF Tracking Bug

Tuesday, April 30, 2013 @ 05:04 PM gHale

There is a vulnerability in Adobe Systems’ Reader program that reveals when and where a PDF document is opened, researchers said.

The issue is not a serious problem and does not allow for remote code execution, said McAfee’s Haifei Li in a blog post. But McAfee does consider it a security problem and notified Adobe. It affects every version of Adobe Reader, including the latest version, 11.0.2, Li said.

Adobe Patches Platforms
Adobe Fixes 4 Flash Flaws
Flash, Reader, Java Fall in Contest
Faux Adobe Sites Flourish

McAfee detected some “unusual” PDF samples, Li said. McAfee withheld some key details of the vulnerability, but did generally describe it.

The issue occurs when someone launches a link to another file path, which calls on a JavaScript API (application programming interface). Reader warns a user when they are going to call on a resource from another place, such as a link on the Internet.

If the external resource does not exist, the warning dialog does not appear, but the API returns some TCP traffic, Li said. By manipulating a second parameter with a special value, the API’s behavior changes to reveal information. That could include information such as the location of a document on a system “by calling the JavaScript ‘this.path’ value,” Li said.

“Malicious senders could exploit this vulnerability to collect sensitive information such as IP address, Internet service provider or even the victim’s computing routine,” Li said. “In addition, our analysis suggests that more information could be collected by calling various PDF JavaScript APIs.”

Li said the problem could work as a solid form of reconnaissance by attackers.

“Some people might leverage this issue just out of curiosity to know who has opened their PDF documents, but others won’t stop there,” Li said. “An APT [advanced persistent threat] attack usually consists of several sophisticated steps. The first step is often collecting information from the victim; this issue opens the door.”

Leave a Reply

You must be logged in to post a comment.