How to protect yourself from the Adobe Reader PDF JavaScript Vulnerability Options

[Grinler]

On Feb 19th Adobe released a security bulletin stating that Adobe Reader is vulnerable to javascript attacks that could allow remote control of your machine. Unfortunately, the fix for this vulnerability is scheduled to be released on March 11th, so that allows enough time for hackers and malware distributors to start ramping up the use of this vulnerability to attack your computers. At the present time there has already been reports of this vulnerability being used.

To protect yourself from these types of attacks it is suggested that you disable javascript from running within PDF documents. For the vast majority of users, this will have no affect on the reading of legitimate PDF documents. It will, though, give a warning when a PDF document is trying to execute javascript and you can then decide if you would like to allow it. To protect yourself, open Adobe Reader and once it is open, click on the Edit menu option and then select Preferences. When the preferences screen opens, click on the javascript category. Then uncheck the checkbox labeled Enable Acrobat javascript. When done, your screen should look like the image below. Then press the OK button to save your settings.

javascript preferences screen in Adobe Reader

Adobe Reader should now be safe from this javascript based attack.

2/26/09 Update: It appears that disabling javascript will stop most attacks, but it is still possible to exploit this vulnerability without javascript. More info here. For now it is advised that you switch to a different PDF reader. There is a good discussion on different types of PDF readers in the comments.

Link : Adobe Security Bulletin

[crzyallday0514]

Thanks. Constantly learning. Like it to be installed for me but would much rather scan it first. Another ? and then hope I'm done for the day on this subject. I uninstalled Adobe Reader but I have Adobe Air (have no idea what that is) and Acrobat.com. Can I uninstall those too or do they have a function I need. Went on Acrobat's website but of course, just got more confused.

[Lloyd T]

Remove them, you don't need them. There should be another Adobe Installer component listed, I'll find out what it is.

[Jay-P VIP]

Acrobat.com is simply the use of that website on your computer.

Adobe Air helps run and streamline applications that need a strong content delivery network. As the name implies, it is an airstream of data transfer for applications.

You can probably get rid of Adobe Air, but if you download an application and it says you need Adobe Air for it, then go ahead and let it install. A lot of applications are starting to use Adobe Air.

The other tool that got installed with Adobe Reader 8 was Adobe SVG Viewer. As far as I know from the Adobe Wikipedia article, this software has no more support behind it. They quit developing it.


Here folks is a comparison of my installs of Foxit Reader versus Adobe Reader 9:
Adobe Reader 9: 145 MB
Foxit Reader: 7.53 MB

[crzyallday0514]

I was shocked when I saw how big Adobe Reader was compared to Foxit. I had Reader 9 and it was 204MB. It has no size at all next to Adobe Air so I might as well keep it since I don't know if any of my applications use it. I don't have Adobe SVG Viewer and it doesn't appear there is anything else except Adobe Flash Player. Do any of ya'll know of an uninstaller program other than using Add/Remove Programs? I got the Total Uninstall but it only does those that you install with them. I read somewhere in my Firefox literature to use ? (some guy's name) uninstaller but I looked all thru my paperwork and of course, when I need it can't find it. Sad thing is I was going thru the paperwork THIS morning and an hr. later couldn't find it. Said it was far better than Add/Remove Programs. Thanks for all your help.

[Jay-P VIP]

CCleaner has a complete uninstall feature on their program!

[crzyallday0514]

Thanks. Just got that recently so haven't yet learned all the features. Good to know don't have to download anything else.

[JohnWho]

Here folks is a comparison of my installs of Foxit Reader versus Adobe Reader 9:
Adobe Reader 9: 145 MB
Foxit Reader: 7.53 MB

And, have you noticed how much quicker Foxit Reader loads?

[Yourhighness]

PDF-XChange zip file is a whole 17.91Mb, but its portable version comes in at 5.46Mb. Eversince I changed from Foxit Reader to this limited editor and full viewer, I never looked back.

[Jay-P VIP]

Foxit reader is amazing!

Yourhighness, I realize that and was going to try it, but I wanted to try Foxit reader, and realized this was amazing!

EDIT: sorry yourhighness, name misspelling

This post has been edited by Jay-P VIP: Feb 26 2009, 05:58 PM

[JohnWho]

They are both good PDF readers and for the majority of folks that only need a program to read PDFs, either is preferrable to Adobe, in my opinion.

FWIW - both open PDFs much faster than Adobe, which is a bonus, too.

[RedDawn]

Foxit Wants to Install Ask Toolbar

Foxit Reader has moved on from being a freeware to crippleware. While it has given users the option to uncheck the toolbar installation, on de-selecting this option, the app is crippled. May not matter though to users just looking for a simple PDF viewer.

[RedDawn]

Another alternative PDF viewer to Adobe that I've come across is Sumatra (basically just a viewer).

Size - only 1.2MB

SumatraPDF requires Windows 2000 or newer (XP, Vista). Windows 95, 98 and ME are not supported.


Also available at MajorGeeks and Download.com.

[RedDawn]

Regarding the Adobe Reader/Acrobat 0-day Vulnerability.

Disabling JavaScript does not prevent exploitation

[Jay-P VIP]

How about:

Xpdf

[Grinler]

Thanks for alerting us. That is not good news. Then it makes sense to switch to a different reader for now.

I have updated the original article with this info.