2

I've been reading about this google/china episode and and it seems that one of the attack vectors used was embedding code (javascript I believe) into PDF documents. This has me worried, I surely don't want any PDF documents executing code on my machine unless I explicitly say so. I run all Linux systems though, so is a simple chmod -x doc.pdf good enough? (Not that any of my PDF files have exec privs anyway)

Are there any tools out there to scan for PDF with embedded code? I'm looking for Linux tools, but if anyone know of any Windows tools for this, I'm sure others would find them useful.

Also, the reader I use now is evince, does anyone know if evince even executes code embedded in PDFs? There's no option to turn it off and evince generally seems to be minimalistic so I suspect not.

3 Answers 3

2

The execute bit on the filesystem will not make a difference for this problem. The execution happens within the reader application. The reader is then dealing with the content that has been loaded, and if that content has javascript it will execute. This is the same scenario as opening an HTML page in a browser. The HTML page doesn't need execute set in order to run the javascript.

As for evince, I don't know for sure...but I think you are correct that it doesn't deal w/ embedded javascript in PDFs.

1
  • 2
    Also many of these exploits use an internal error in the vulnerable app (buffer overflow in a parser for example) to cause the app to execute entirely new code that is embedded somewhere else in the data. In the more severe cases the bug is in a system function and runs at an even higher privilege than the application that "delivers" the payload. Examples in the past have included exploits that were delivered via image files that under normal circumstances have no "active" content.
    – Helvick
    Jan 15, 2010 at 19:21
1

An antivirus program should handle this case, and there are of course plenty of those for Windows. Since PDF files are nowadays a pretty common attack vector, PDF file scanning is a standard feature of these products. It won't give you a contains code/does not contain code answer, but it will block or remove files that contain known or potential exploits.

2
  • This is not 100% accurate. PDF files can be encrypted entirely or partially, and in such cases an antivirus program will not be able to inspect the file until it is probably "too late".
    – yms
    Jun 19, 2012 at 18:17
  • A good antivirus program can handle that. It will check the code "while" it is being run. Not as nice as checking beforehand, of course. The point is, antivirus programs are pretty good at dealing with potentially problematic PDFs. Anything you put together manually will probably not be as good. Jun 21, 2012 at 21:59
1

I can inform you, that Google Chrome's built in pdf viewer does not run javascript at the moment.

This is a problem for me as I am trying to use this code to fill in form fields, but may be of interest to you in preventing possible malicious attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .