PDF Backdoors

I've been following a discussion regarding backdooring PDF files on the full-disclosure mailing list originally posted by David Kierznowski and on eWeek. At his site, he discusses two techniques for exploiting Adobe Acrobat Reader and Professional. Within the POC pdf, there's executable code that will launch a new browser window when opened. This is just a proof-of-concept, but it can be used to open web pages containg malicious code for exploiting holes in IE or Firefox.

The exploit does not affect other PDF readers, like Foxit or xpdf. It does seem to work on other os' as well, including Ubuntu and Fedora Core 5.

Posted by Marcin on Saturday, September 16, 2006 in Security.