Adobe Reader

The software of Adobe Reader is the international standard which is used for viewing, printing and entering of comments into the documents PDF during the work on the most different platforms.

2019: Vulnerability which allowed to steal NTLM hashes is eliminated

On February 12, 2019 it became known that specialists of ACROS Security released the temporary patch eliminating dangerous vulnerability in Adobe Reader which gave to malefactors an opportunity to steal NTLM hashes.

This vulnerability allows the PDF document to send automatically a SMB request for the server right after the document is open. The SMB protocol allows the application or the user to get access to files on a remote server. SMB requests include NTLM hashes (NT LAN Manager) which attacking can steal. Besides, vulnerability allows the malefactor to learn when the user browsed the document.

Vulnerability mentions the latest version of Adobe Reader DC (2019.010.20069) and as researchers believe, the previous releases of software can be subject to it.

Vulnerability was detected by the researcher of security Alex Inführ at the end of January, 2019. He also published the PoC-code for its operation.

The revealed problem was similar to earlier described CVE-2018-4993 in an element of the PDF documents allowing automatic loading of other PDF file from a remote public resource. Adobe corrected this problem, having added warning in attempt of the document to poison a request to the remote public folder.

Unlike CVE-2018-4993 operating record/F for remote loading of files, the described vulnerability uses a possibility of loading of remote XML-stylesheets through SMB requests. What is interesting, when loading XML-tables under the HTTP protocol the adequate notice is displayed, however when using an UNC way warning is not issued.

The temporary patch adds warning when loading stylesheets through UNC when the document tries to get file access in network. According to representatives of Adobe, the company is going to release an official patch until the end of February, 2019^[1].

2012: An opportunity to certify documents the signature

In updating of the beginning of 2012 of Adobe Reader there was an opportunity to certify documents the signature — this, but not a set of digits. For this purpose it is necessary to take the scanned image of the signature and to import to the document, or using the Only I Sign function to draw the signature with a mouse. One more function, Send for Signature, allows to send the document for the signature and later to receive it back.

Technologies of EchoSign company which Adobe purchased in the summer of 2011 are involved in the updated Reader. When installing updating the user is offered to try free of charge services of Echosign within a month. Upon termination of the trial period of a quotation will make from $15 to $400 a month depending on number and location of users.

For January, 2012 similar applications and online services for assurance of documents the electronic signature offer also other companies, for example, of Docusign and Ascentia Docs.

2011

For May, 2011 the free Adobe Reader program represents the only preview player of the PDF files which allows to open the documents PDF and to work with different content type, including the filled forms and multimedia files.

Notes