Comments on: PDF Security – Avoiding Exploits http://www.pcmech.com/article/pdf-security-avoiding-exploits/ Helping Normal People Get Their Geek On Wed, 15 Feb 2012 10:29:00 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Steve RJhttp://www.pcmech.com/article/pdf-security-avoiding-exploits/comment-page-1/#comment-16963 Steve RJ Mon, 17 Nov 2008 23:28:07 +0000 http://www.pcmech.com/?p=8417#comment-16963 Early versions of Foxit reader did not support javascript. I know this because our company tested LockLizard viewer for secure PDF files, which we were told was based on the Foxit version 1 SDK, and javascript is not supported. In fact all active content is prevented from loading, but it only works with LockLizard protected PDF files. I guess we are back to the age old question of security vs usability... Early versions of Foxit reader did not support javascript. I know this because our company tested LockLizard viewer for secure PDF files, which we were told was based on the Foxit version 1 SDK, and javascript is not supported. In fact all active content is prevented from loading, but it only works with LockLizard protected PDF files. I guess we are back to the age old question of security vs usability…

]]> By: Joelhttp://www.pcmech.com/article/pdf-security-avoiding-exploits/comment-page-1/#comment-16682 Joel Mon, 10 Nov 2008 21:22:42 +0000 http://www.pcmech.com/?p=8417#comment-16682 Even the exploit doesn't affect Adobe Reader version 9 is good to disable JavaScript just in case. About FoxReader there must be a way to disable JavaScript also or at least another version that covers this hole. Even the exploit doesn’t affect Adobe Reader version 9 is good to disable JavaScript just in case. About FoxReader there must be a way to disable JavaScript also or at least another version that covers this hole.

]]> By: John Kirkhamhttp://www.pcmech.com/article/pdf-security-avoiding-exploits/comment-page-1/#comment-16616 John Kirkham Sat, 08 Nov 2008 06:44:26 +0000 http://www.pcmech.com/?p=8417#comment-16616 Same as SAP said but I thought this problem was only tested & found in Foxit first up in the last week. Same as SAP said but I thought this problem was only tested & found in Foxit first up in the last week.

]]> By: SAPhttp://www.pcmech.com/article/pdf-security-avoiding-exploits/comment-page-1/#comment-16595 SAP Fri, 07 Nov 2008 14:38:12 +0000 http://www.pcmech.com/?p=8417#comment-16595 I've just noticed that the Net Security article cited in the article specifically says that the Adobe Reader bug is the same as the previously discovered bug in FoxIt.Foxit *was* affected by the bug (CVE-2008-1104), but it was fixed some time ago.So presumably Foxit Reader does support Javascript.Though it is much smaller and quicker to load than Adobese Reader. I’ve just noticed that the Net Security article cited in the article specifically says that the Adobe Reader bug is the same as the previously discovered bug in FoxIt.

Foxit *was* affected by the bug (CVE-2008-1104), but it was fixed some time ago.

So presumably Foxit Reader does support Javascript.

Though it is much smaller and quicker to load than Adobese Reader.

]]> By: SAPhttp://www.pcmech.com/article/pdf-security-avoiding-exploits/comment-page-1/#comment-16594 SAP Fri, 07 Nov 2008 14:23:22 +0000 http://www.pcmech.com/?p=8417#comment-16594 I have seen a PDF file containing some forms to fill in.There was some scripting involved which checked that the appropriate fields had been completed. Perhaps that is what Javascript is for.One advantage of using JS rather than inventing a new scripting language is that people don't need to learn a new language.However, JS *should* have been added in such a way that it could only be used to affect elements within the PDF. I have seen a PDF file containing some forms to fill in.

There was some scripting involved which checked that the appropriate fields had been completed. Perhaps that is what Javascript is for.

One advantage of using JS rather than inventing a new scripting language is that people don’t need to learn a new language.

However, JS *should* have been added in such a way that it could only be used to affect elements within the PDF.

]]>