What kind of measures can we take so that users with older Acrobat versions are not compromised?

Hope that helps!

Bye,
Seb

well one way to prevent people from exploiting your customers is to add the following directive to Apache’s httpd.conf:

Header unset Content-Disposition
Header add Content-Disposition “attachment; filename=document.pdf”

This will cause a save/open dialogue to pop up every time a user tries to download a .pdf file. As the “normal” Acrobat is not vulnerable (it’s just the plugin), potentially attached malicious code will not be executed. If one wants to keep the original name of the .pdf file untouched, then one could use Apache’s environment variables rather than setting it to “filename=document.pdf”.

Bye,
Sebastian

Disable JavaScript or update to Acrobat 8.

Or disable Acrobat plugin, or even delete it. For your main browser or for all browsers in the system. There are many suggestions.

Guys, as Google tell me, the are up to 317 000 000 sites in the Internet which have pdf files (and they all have this vulnerability). So every admin of every site and every user need to deal with this Universal PDF XSS.

I got http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here to run in FF 1.5.0.7 on windows XP, but the file one did not run in that version

Although the alert did not work for me on FF (up to date 2.0.0.1) this did work.

file:///C:/Program%20Files/Adobe/Acrobat%206.0/Help/ENU/Pdfmark.pdf#a=javascript:window.location.href=’http://www.google.com’;

So my guess is the bug exists just because the plugin takes the window over, we don’t get to see that window, however the bug does exist, and can be used.

Joel