News for hackers. Stuff that matters.

A comment on Security Flaws in Adobe Acrobat Reader Allow Gaining Root on macOS Silently. Parent comment

Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by crazygringo on Thursday May 14, 2020 @03:03PM (#23183884)
People keep saying this, but the form-filling tools are basically identical to Reader's. I don't get it.

What Preview doesn't support is JavaScript, as far as I can tell, so it can't work with "smart" PDF's, e.g. that will do calculations for you.

Is that what you're referring to? Or I'd love to know any specific issue you've run into with form fields.

[ Parent | on HN ]
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by dathinab on Thursday May 14, 2020 @04:01PM (#23184624)
The problem is that if the PDF forms where create with an Adobe program even things which should work with generic PDF might not do so because the Adobe program used JS or whatever below the cover.

EDIT: I looked into some of the PDFs again and it seems I had been wrong. Not sure what they use but it doesn't seem to be js.

EDIT EDIT: But I found other forms which where affected see my response below.

[ Parent | on HN ]
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by crazygringo on Thursday May 14, 2020 @04:22PM (#23184876)
Is that a real thing?

I've encountered JavaScript-heavy PDF's before, but which were obviously so. (Automatically calculating values for one form field based on another, generating QR codes, etc.)

I've never come across a seemingly "normal" form PDF but which secretly used JavaScript for normal things like form filling, so that normal form-filling tools didn't work. I don't understand why the normal PDF type-in-a-text-box tool wouldn't work.

Have you actually come across this? Can you point to any examples?

[ Parent | on HN ]
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by dathinab on Thursday May 14, 2020 @05:46PM (#23185949)
While (like it can be seen in the EDIT) the forms I found where not affected with JS. Other forms from my uni where.

For example I found following:

`/JS (if \(this.getField\("inst1"\).value == "bitte auswählen"\){\r\nthis.getField\("Hinweis"\).display = 2\r\n} else\r\n{\r\nthis.getField\("Hinweis"\).display = 1\r\n}\r\n)$ /S /JavaScript`

This (in the given PDF) causes a "notice" overlapped on top of other form fields to disappear once the first multiple choice field was selected.

So if you try to fill it out without JS some form fields are not visible (but selectable by tab). Luckily it's not included in prints.

[ Parent | on HN ]
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by hn_throwaway_99 on Thursday May 14, 2020 @05:41PM (#23185881)
Yes, as another commenter pointed out, Canadian govt citizenship forms, e.g. https://www.canada.ca/en/immigration-refugees-citizenship/se...
[ Parent | on HN ]
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by dathinab on Thursday May 14, 2020 @05:09PM (#23185477)
I have run into this with regard to basic, but "slightly" more advanced features then text fields on forms in my university.

You can be sure that even Adobe won't add JS for forms with plain text fields. ;=)

EDIT: I looked into some of the PDFs again and it seems I had been wrong. Not sure what they use but it doesn't seem to be js.

Sorry about this.

[ Parent | on HN ]
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by abdullahkhalids on Thursday May 14, 2020 @05:00PM (#23185373)
The Canadian govt forms like Visa application forms or Tax forms don't work on any Linux pdf tool that I tested with. The pdf would display empty with a JS error message. This was a few years ago though.

Had to install the linux version of Adobe, which is many years out of date now.

[ Parent | on HN ]