Yet another 0-day pdf exploit in the wild

[mouser]

Yet another 0-day pdf exploit in the wild
http://community.ca.com/blogs/securityadvisor/archive/2009/12/15/adobe-pdf-0-day-in-the-wild.aspx

that post tells you how to disable pdf rendering inside your browser from automatically happening.

i think that one of the worst ideas in the history of computing was letting adobe pdf render by default in the browser panel.. it's one of the more consistently exploited vulnerabilities.

no one should have pdf rendering in the browser on by default.  someone needs to make a page dedicated to helping people test if they do, and walking them through the process of disabling it if they do.  such a website would make a great little NANY project by the way.

[f0dder]

Yeah, it's a big mistake... I've always hated any kind of in-browser document handling anyway.

[Lashiec]

I always wondered what's the point in having a browser plugin for Acrobat, since the standalone program launches as fast and has the same exact functionality

And if I were Adobe, I would ship next major version of Acrobat with JavaScript disabled. If a PDF really needs such function, the program usually warns you, so...

[f0dder]

And if I were Adobe, I would ship next major version of Acrobat with JavaScript disabled. If a PDF really needs such function, the program usually warns you, so...

Doing so would be admitting defeat, though - probably not something they want to do

[rxantos]

More important. Why is the rendering inside the browser on by default. Adobe should add a section on their installer saying. "Do you want to enanos browser support?" and have the default set to no.

Besides the pluggin is incredible fat on resources. I found that the reader loads a lot faster.

[OldElmerFudd]

Do all readers open in browsers like Adobe? Even my favorite, PDF-XChange does. At least it's faster and lighter on resources.

[ajp]

for PDF-XChange (my favorite, too!)
File > Preferences > File associations > Make PDF-XChange the Default PDF Viewer > Display PDF in Browser [ ] (uncheck)
Should do the trick.

I haven't installed Adobe Reader in ages. First, I stuck to version 7, then I switched to Foxit, and now it's PDF-XChange. Never looking back, I guess. And I've always hated when they get embeded on my browser window.

[erikts]

I use PDF-Xchange Viewer and when I inspect the preference (Edit|Preferences|File Associations), Display PDF in Browser is unchecked by default.

[Deozaan]

What does 0-day mean?

[f0dder]

What does 0-day mean?

"Breaking news".

In the exploit world, it's stuff that isn't generally known yet, and thus hasn't been patched by the vendor(s).

[Ehtyar]

Adobe Reader vuln hit with unusually advanced attack

Finally, maybe Adobe will finally get some bad press and we'll get non-shitty code in our PDF readers...however unlikely...

Ehtyar.