September 6, 2017 By Mark Samuels 2 min read

A little-known PDF flaw in a parsing library that was originally discovered six years ago is present in many contemporary file viewers and could create issues for users.

German software developer Andreas Bogk found the original flaw in a PDF parsing component that forms part of the Linux-based document viewing app Evince, reported Bleeping Computer. Bogk, who presented his original research at the 2011 Chaos Communication Camp, helped Evince to resolve the bug.

However, additional research by fellow German developer Hanno Böck recently showed the vulnerability is still an issue in other apps six years later.

Discovering the PDF Flaw

Bogk’s original research from 2011 highlighted how PDF files that cross-referenced internal xref tables would create a continuous loop. This loop would devour local computing resources, leading to the consumption of available memory and the inevitable crashing of the Evince app.

Little attention was paid to the flaw six years ago, reported Bleeping Computer. The bug was not considered a critical security issue, and it was believed that the vulnerability was limited to Evince. However, Böck recently undertook a period of testing, using a basic security technique known as fuzzing, and found the bug in many other popular PDF viewers.

Böck said in a blog post on The Fuzzing Project that he uses fuzzing on a regular basis. The security technique relies on the input of huge amounts of random data to test the responses of a program and to seek out vulnerabilities. Böck said that he regularly reports fuzzing-related bugs and always shares the sample file that initiates the flaw.

Taking Note of Affected Platforms

Böck reiterated that the PDF vulnerability should not be viewed as a significant security concern. However, he also said that the flaw is undesirable and should be fixed — and found it remarkable that a six-year-old bug is still affecting many popular PDF viewers.

In his blog post, Böck said that affected platforms include Mozilla Firefox, Google Chrome, Microsoft Edge and Ghostscript. Böck reported the flaw to the manufacturers of affected products, and these firms are currently creating and deploying patches, Bleeping Computer noted. Adobe Reader and Apple’s OS X internal PDF viewer were unaffected.

Building More Secure Products

While it is good news that some products are unaffected, news of the flaw raises long-standing concerns about information security practices. According to Böck, establishing security concerns often relies on rediscovering old flaws.

He suggested that, as standard practice, manufacturers that maintain affected software should use the bug-triggering sample, known as Bogk loop bug, in their test suites. He added that manufacturers could also reach out to competitors and check for errors in their test suites.

IT managers and users should be aware of the flaw highlighted by Böck and look out for fixes. Manufacturers should also take steps to find long-term fixes for historical vulnerabilities.

More from

What is the Open-Source Software Security Initiative (OS3I)?

3 min read - The Open-Source Software Security Initiative (OS3I) recently released Securing the Open-Source Software Ecosystem report, which details the members’ current priorities and recommended cybersecurity solutions. The accompanying fact sheet also provides the highlights of the report. The OS3I includes both federal departments and agencies working together to deliver policy solutions to secure and defend the ecosystem. The new initiative is part of the overall National Cybersecurity Strategy.After the Log4Shell vulnerability in 2021, the Biden-Harris administration committed to improving the security of…

Widespread exploitation of recently disclosed Ivanti vulnerabilities

6 min read - IBM X-Force has assisted several organizations in responding to successful compromises involving the Ivanti appliance vulnerabilities disclosed in January 2024. Analysis of these incidents has identified several Ivanti file modifications that align with current public reporting. Additionally, IBM researchers have observed specific attack techniques involving the theft of authentication token data not readily noted in current public sources. The blog details the results of this research to assist organizations in protecting against these threats. Key Findings: IBM research teams have…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today