Adobe Systems’ Reader vulnerability reveals where a PDF is opened

By Pierluigi Paganini, Editor-in-Chief, CDM

May 1, 2013, 11:30 am EST

The McAfee security firm found an Adobe Reader vulnerability that reveals where a PDF document is opened.

The McAfee security firm found an Adobe Reader vulnerability that reveals where a PDF document is opened, once again Adobe products are the center of attention of security experts after the numerous attacks that have exploited flaws in its products for cyber espionage campaigns.

McAfee provided only general information to the press for obvious reasons not supplying details of the Adobe Reader vulnerability that affect all Adobe Reader versions, including last one.

It must be clear that the Adobe Reader vulnerability discovered doesn’t allow remote code execution, anyway McAfee consider it a security issue and have alerted the Adobe Company.

The blog post reported:

“Recently, we detected some unusual PDF samples. After some investigation, we successfully identified that the samples are exploiting an unpatched security issue in every version of Adobe Reader including the latest “sandboxed” Reader XI (11.0.2). Although the issue is not a serious problem (such as allowing code execution), it does let people track the usage of a PDF. Specifically, it allows the sender to see when and where the PDF is opened.”

The anomalous behavior is observable when the launches a link to another file path, which calls on a JavaScript API. The Adobe Reader displays a security warning to inform the user that he is going to open an external resource such as an Internet URL.


The Reader doesn’t provide information on the availability of the external resource, if doesn’t exist in fact the API doesn’t display any message and returns any TCP traffic.


Haifei Li, author of the post, revealed that it is possible to manipulate a parameter of the API to obtain information on the document such as the location of a document on a system (using the JavaScript call this.path).

The information could be collected by the attacker to gather information on the target as explained in the post:

“Malicious senders could exploit this vulnerability to collect sensitive information such as IP address, Internet service provider or even the victim’s computing routine,” Li wrote. “In addition, our analysis suggests that more information could be collected by calling various PDF JavaScript APIs.”

“An APT [advanced persistent threat] attack usually consists of several sophisticated steps. The first step is often collecting information from the victim; this issue opens the door.”

McAfee suggests to the users to disable JavaScript in Reader until the patch will be released.

(Source: CDM & Security Affairs – Security)

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2022

We are in our 10th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.


10th Anniversary Exclusive Top 100 CISO Conference & Innovators Showcase