Adobe bolsters Reader, Acrobat XI security
Updated Adobe Reader and Acrobat offer a better sandbox and new tools that can can block more attacks, Adobe says
IDG News Service - The recently launched Adobe Reader and Adobe Acrobat XI come with new security features and an improved sandbox that will make the products harder to attack and exploit, according to Adobe.
The sandboxing feature known as the Protected Mode that was first introduced in Adobe Reader X proved successful at mitigating traditional PDF exploits. The technology works by isolating certain Adobe Reader operations in a strictly controlled environment and makes it very hard for attackers to write and execute malicious code on a system after exploiting a vulnerability in the product.
"Since we added sandbox protection to Adobe Reader and Acrobat, we have not seen any exploits in the wild that break out of the Adobe Reader and Acrobat X sandbox," Priyank Choudhury, a security researcher within Adobe's Secure Software Engineering Team, said Wednesday in a blog post.
However, this doesn't mean that the Adobe Reader X sandbox can prevent all types of attacks. For example, the sandbox was primarily designed to restrict write operations, not read ones, which means that potential attackers can steal sensitive information from a system after exploiting an Adobe Reader X vulnerability.
That's no longer a problem in Adobe Reader XI, Choudhury said. "In Adobe Reader XI, we have added data theft prevention capabilities by extending the sandbox to restrict read-only activities to help protect against attackers seeking to read sensitive information on the user's computer."
"I've warned before that Adobe Reader X's sandbox is a write sandbox, e.g. that reading is still fully permitted and thus still allows stealing of information," Didier Stevens, a security researcher well known for his PDF security work, said Thursday via email. "I tested that."
Stevens assumes that the new sandbox model in Adobe Reader XI prohibits the reading of files and registry keys, but hasn't had a chance to test it yet. If that's the case, it would be an important improvement, he said.
The new version of Adobe Reader also comes with a Protected View mode that further strengthens the sandbox by creating a separate window station -- a separate securable clipboard and desktop -- for the PDF viewing process. This function is designed to block so-called screen-scraping attacks in which one application reads data from the display output of a different program running on the same desktop.
Adobe Acrobat already had a Protected View mode that has been enhanced in the new version. "Protected View behaves identically for Adobe Reader and Acrobat, whether viewing PDF files in the standalone product or in the browser," Choudhury said.
The support for Address Space Layout Randomization (ASLR), a memory-based anti-exploitation technology, has also been improved in the new Adobe Reader and Acrobat versions.
- 2014 Gartner Magic Quadrant Report For the 7th year in a row, Riverbed is in the "Leaders" Quadrant of the 2014 Magic Quadrant for WAN Optimization Controllers. In...
- Improving Business Value of WAN Optimization Want to achieve faster ROI with WAN optimization? Read the latest IDC report and discover how you can cut IT costs without compromising...
- IDC ROI Infographic Trends such as evolving communication patterns, connection types, applications and bandwidth can have an impact on enterprise organizations. Learn how IT organizations can...
- Riverbed Optimization System: Technical Overview View now>>
- Transform Your IT Service Management Watch this webinar, to learn how EasyVista can increase IT productivity & efficiency and deliver streamlined & integrated IT Service & Asset Mgmt.
- Top 4 Digital Signage Fails Join RMG Networks for a look at four of the most common reasons digital signage fails in corporate businesses. Learn about strategies to... All Applications White Papers | Webcasts