Alarm over possible PDF flaw
Vulnerability announcement hyped to disaster level.
The announcement of a potentially serious vulnerability in the ubiquitous
Adobe PDF document format sparked considerable media attention last month,
in some cases hyped to the level of a major disaster waiting to happen.
The vulnerability was found by researcher Petko Petkov and was announced in
a blog entry. Little detail was provided at the time of the announcement,
as the flaw had only just been reported to Adobe and no fix was yet
available. As evidence, Petkov later released a video demonstration of the
vulnerability being exploited, with PDF files shown executing Notepad and
the Windows Calculator on opening. No official announcement regarding the
issue has yet emerged from Adobe, but the researcher claims to have had
private confirmation of his discovery from the company.
The blog entry was quickly picked up by fellow hackers, who joined in a
lengthy debate on the find on the blog's comment page, and by the world's
media, with initial sensible coverage in the technical press quickly giving
way to alarmist pieces warning of zero-day attacks despite no exploit code
yet having been spotted in use in the wild.
This latest example demonstrates once more the problems of full disclosure.
While most vulnerabilities are not reported publicly until the appropriate
fix can be made, the argument that people should be warned that a flaw
exists so that they can take the necessary precautions is strong. The side
effects, of potentially causing widespread panic, and also of telling the
bad guys where they should be looking, need to be carefully weighed in the
balance. The advent of vulnerability marketplaces adds another layer of
confusion to the issue.
01 October 2007
Tags:
adobe, full disclosure, pdf, vulnerability.
del.icio.us 
digg this
