Why turning off Javascript won’t help this time
As you may have heard, there’s a new Adobe PDF-or-Flash-or-something 0-day in the
wild. So this is a quick note about how it’s implemented, but this
blog post is not going to cover any details about the exploit itself.
Most of the Acrobat exploits over the last several months use the, now
common, heap spraying
technique, implemented in
Javascript/ECMAscript, a
Turing complete
language that Adobe thought would
go well with static documents. (Cause that went so well
for Postscript)
(Ironically, PDF has now come full circle back
to having the features of Postscript that it was
trying to get away from.)
The exploit could be made far far less reliable, by
disabling Javascript in
your Adobe Acrobat Reader.
But apparently there’s no easy way to disable Flash through the UI.
US-CERT recommends renaming the
%ProgramFiles%\Adobe\Reader 9.0\Reader\authplay.dll
and
%ProgramFiles%\Adobe\Reader 9.0\Reader\rt3d.dll
files. [Edit: Actually the source for this advice is the Adobe Product Security Incident Response Team (PSIRT).]
Anyway, here’s why… Flash has it’s own version of ECMAScript called
Actionscript, and whoever wrote this new 0-day, finally did something new by
implementing the heap-spray routine with Actionscript inside of Flash.
