A little-known PDF flaw in a parsing library that was originally discovered six years ago is present in many contemporary file viewers and could create issues for users.
German software developer Andreas Bogk found the original flaw in a PDF parsing component that forms part of the Linux-based document viewing app Evince, reported Bleeping Computer. Bogk, who presented his original research at the 2011 Chaos Communication Camp, helped Evince to resolve the bug.
However, additional research by fellow German developer Hanno Böck recently showed the vulnerability is still an issue in other apps six years later.
Discovering the PDF Flaw
Bogk’s original research from 2011 highlighted how PDF files that cross-referenced internal xref tables would create a continuous loop. This loop would devour local computing resources, leading to the consumption of available memory and the inevitable crashing of the Evince app.
Little attention was paid to the flaw six years ago, reported Bleeping Computer. The bug was not considered a critical security issue, and it was believed that the vulnerability was limited to Evince. However, Böck recently undertook a period of testing, using a basic security technique known as fuzzing, and found the bug in many other popular PDF viewers.
Böck said in a blog post on The Fuzzing Project that he uses fuzzing on a regular basis. The security technique relies on the input of huge amounts of random data to test the responses of a program and to seek out vulnerabilities. Böck said that he regularly reports fuzzing-related bugs and always shares the sample file that initiates the flaw.
Taking Note of Affected Platforms
Böck reiterated that the PDF vulnerability should not be viewed as a significant security concern. However, he also said that the flaw is undesirable and should be fixed — and found it remarkable that a six-year-old bug is still affecting many popular PDF viewers.
In his blog post, Böck said that affected platforms include Mozilla Firefox, Google Chrome, Microsoft Edge and Ghostscript. Böck reported the flaw to the manufacturers of affected products, and these firms are currently creating and deploying patches, Bleeping Computer noted. Adobe Reader and Apple’s OS X internal PDF viewer were unaffected.
Building More Secure Products
While it is good news that some products are unaffected, news of the flaw raises long-standing concerns about information security practices. According to Böck, establishing security concerns often relies on rediscovering old flaws.
He suggested that, as standard practice, manufacturers that maintain affected software should use the bug-triggering sample, known as Bogk loop bug, in their test suites. He added that manufacturers could also reach out to competitors and check for errors in their test suites.
IT managers and users should be aware of the flaw highlighted by Böck and look out for fixes. Manufacturers should also take steps to find long-term fixes for historical vulnerabilities.