Supreme Court Forms and Adobe Reader PDF Security Problem

Dec. 27, 2008 - PRLog -- PDF Files - Adobe Reader Security Threat

For the past few years computer systems have been vulnerable to an Internet attack when using Adobes' Acrobat Reader. It has been determined that the security breach occurs  while opening and printing .PDF files.

Computer hackers discovered this security hole a few years ago. Once a hacker finds your computer they usually make themselves the administrator of your computer. Once they have Administrator Rights they have complete access to your computer and your documents. They will usually copy all the files from the compromised computer system.

A small piece of code called, JavaScript, can sneak into your computer without
the user knowing it. This problem does not seem to be going away. Our research staff have spoken to some of the most knowledgeable Internet Security programmers working today. They all agree that you never know if you have a problem until it's too late.

As stated on CoreSecurity.com:
http://www.coresecurity.com/content/adobe-reader-buffer-overflow
"Adobe Reader suffers from a stack buffer overflow when parsing specially crafted (invalid) PDF files. The vulnerability is caused due to a boundary error when parsing format strings containing a floating point specifier in the "util.printf()" JavaScript function. Successful exploitation of the vulnerability requires that users open a maliciously crafted PDF file thereby allowing attackers to gain access to vulnerable systems and assume the privileges of a user running Acrobat Reader. Adobe Reader version 9, which was released in June 2008, is currently not vulnerable to the reported problem. "

February 2008: VupenSecurity.com: http://www.vupen.com/english/advisories/2008/0425
Multiple vulnerabilities have been identified in Adobe Reader, which could be exploited by attackers to bypass security restrictions or take complete control of an affected system. These issues are caused by input validation and buffer overflow errors when handling malformed data, which could be exploited by attackers to execute arbitrary code by tricking a user into opening a malicious document.

Adobe Press Release: May 2008
http://www.adobe.com/support/security/bulletins/apsb08-13...

Research Credits:
Vulnerabilities reported by Tavis Ormandy, Will Drewry (Google Security Team), cocoruder (Fortinet Security Research Team), Greg MacManus (iDefense Labs), Paul Craig (Security-Assessment) and Zero Day Initiative.

*
Timeline History of Patches & Updates For Acrobat Reader:

http://news.zdnet.com/2100-1009_22-150766.html

2007: Adobe recommends updating to version 8.
https://forums.symantec.com/syment/blog/article?message.uid=305463

2008: Adobe recommends updating to version 9.
http://www.adobe.com/support/security/bulletins/apsb08-19.html
http://www.theregister.co.uk/2008/11/04/adobe_reader_flaw/

2009: ?

We see an unfortunate trend re-occurring with the Adobe Acrobat Reader.
When opening a .PDF form you could be opening your computer and your files to the entire computer hacker community on the Internet.

For 2009 We would recommend re-thinking your SCAO form strategy if your using PDF files.

Using our SCAO Michigan Supreme Court Forms would avoid this situation.
Our program is a stand-alone Windows software program which installs easily onto your computer. Why wait until it is too late. Is it worth the aggravation and embarrassment?
Once your system is compromised you will no longer have control of your computer or your files and documents.

For questions and comments please call 1 800 701 6332.

# # #

SupremeCourtForms.com sold their software through West Publishing for eight years. SupremeCourtForms.com are currently marketed through our own company, Soft Cell, Inc., a subsidiary of Top of Troy Computer Services, Inc.