Printable View
Hey folks, I am sure you are all aware of the rising problems with malicious PDFs. Most of them make use of JS within the PDF. I came across an article that walks you through disabling javascript in PDFs using group policy.
http://praetorianprefect.com/archive...he-enterprise/
The Wolfman is very excited to bring this article to his work tomorrow. I was not aware GPO could disable Java in Acrobat. Very cool indeed.
This PDF exploit has been bothering us for a while now....
Thanks Westin
The real question here is why does Adobe require it be turned on for all documents if you view a document with js. Why can't I enable it only for the current document?
They should do like Microsoft does with macros in office documents. Ask the user if he want to enable JS for the document he is opening.
Quote:
Despite Danger, Adobe Says JavaScript Support Important
~~
In a Q&A (listen to podcast) with Threatpost editors Dennis Fisher and Ryan Naraine, Adobe security chief Brad Arkin says the removal of JavaScript support is a non-starter because it's an integral part of how users do form submissions.
"Anytime you’re working with a PDF where you’re entering information, JavaScript is used to do things like verify that the date you entered is the right format. If you’re entering a phone number for a certain country it’ll verify that you’ve got the right number of digits. When you click “submit” on the form it’ll go to the right place. All of this stuff has JavaScript behind the scenes making it work and it's difficult to remove without causing problems," Arkin explained.
http://threatpost.com/en_us/blogs/de...s+Most+Popular
I am not sure that the pros outweigh the cons...
I don't know about you guys and your work, but it turns out a lot of companies here in Canada do require javascript scripting in Adobe Reader.
The Wolfman was in meetings all day regarding this PDF issue, and the developers were quite clear that javascript is required for the majority of their custom forms.
Who would have thought....
And why are we still concerned about this PDF issue and not Aurora? :)
Heh. I work at a school. Haven't had any complaints yet. As far as Aurora, MS is supposedly going to come out with an emergency patch this Friday. ??Quote:
Originally Posted by wolfman1984