How to protect yourself from the Adobe Reader PDF JavaScript Vulnerability Options

[Grinler]

On Feb 19th Adobe released a security bulletin stating that Adobe Reader is vulnerable to javascript attacks that could allow remote control of your machine. Unfortunately, the fix for this vulnerability is scheduled to be released on March 11th, so that allows enough time for hackers and malware distributors to start ramping up the use of this vulnerability to attack your computers. At the present time there has already been reports of this vulnerability being used.

To protect yourself from these types of attacks it is suggested that you disable javascript from running within PDF documents. For the vast majority of users, this will have no affect on the reading of legitimate PDF documents. It will, though, give a warning when a PDF document is trying to execute javascript and you can then decide if you would like to allow it. To protect yourself, open Adobe Reader and once it is open, click on the Edit menu option and then select Preferences. When the preferences screen opens, click on the javascript category. Then uncheck the checkbox labeled Enable Acrobat javascript. When done, your screen should look like the image below. Then press the OK button to save your settings.

javascript preferences screen in Adobe Reader

Adobe Reader should now be safe from this javascript based attack.

2/26/09 Update: It appears that disabling javascript will stop most attacks, but it is still possible to exploit this vulnerability without javascript. More info here. For now it is advised that you switch to a different PDF reader. There is a good discussion on different types of PDF readers in the comments.

Link : Adobe Security Bulletin