Software Engineering Institute

Adobe Reader and the Adobe Acrobat family of software are designed to create, view, and edit Portable Document Format (PDF) files. Adobe Reader is widely deployed, and the Acrobat Reader Plug-In displays PDF inside a web browser.

Adobe Reader and Acrobat support JavaScript. According to the JavaScript for Acrobat API reference, certain methods are designed to be unavailable or have security restrictions in a non-privileged context. As a result, it should not be possible to call these methods from non-privileged events, such as page open or mouse-up.

Adobe Acrobat and Reader fail to enforce the Privileged Context and Safe Path restrictions on certain JavaScript methods. This failure results in a vulnerability that allows methods that accept a cPath parameter to write to an arbitrary file extension and arbitrary path rather than those intended to be limited by the Safe Path restriction.

By convincing a user to open a specially crafted PDF file, an attacker may be able to execute certain privileged JavaScript methods that can be used to create arbitrary files and folders on an affected system, subject to the normal permissions of the victim user.

Update
Adobe has released updates to address this issue. Users are encouraged to read Adobe Security Bulletin APSB09-15 and update vulnerable versions of Adobe Reader and Acrobat.

Enable Data Execution Prevention (DEP) in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts "Understanding DEP as a mitigation technology" part 1 and part 2. Use of DEP should be considered in conjunction with the application of patches or other mitigations described in this document.

Disable JavaScript in Adobe Reader and Acrobat

Disabling JavaScript prevents these vulnerabilities from being exploited and reduces attack surface. If this workaround is applied to updated versions of Adobe Reader and Acrobat, it may protect against future vulnerabilities.

To disable JavaScript in Adobe Reader:

1. Open Adobe Acrobat Reader.
2. Open the Edit menu.
3. Choose the Preferences... option.
4. Choose the JavaScript section.
5. Uncheck the Enable Acrobat JavaScript check box.

1. Open Adobe Acrobat Reader.
2. Open the Edit menu.
3. Choose the Preferences... option.
4. Choose the Internet section.
5. Uncheck the Display PDF in browser check box.