Windows needs a built-in PDF viewer, argues researcher

Microsoft should add a basic PDF viewer to Windows to help protect users from the spike in attacks exploiting bugs in Adobe's Reader, a security researcher said Friday.

"Apple does this with its Preview [application], and Microsoft should, too," said Sean Sullivan, a security advisor with Finnish antivirus vendor F-Secure's North American operation. "I just want to view and read PDFs. I don't want to listen to them or watch them or launch executables from them or run JavaScript," Sullivan added, referring to several advanced features that Abobe's own PDF viewer, the for-free Reader, supports.

Some of those features, including Reader's support of JavaScript and the PDF specification's support for the /Launch function, have been exploited by attackers in increasing numbers since 2008. According to tallies by antivirus vendor McAfee, PDF exploits were up more than eight times in 2009 compared to the year before, a trend that has continued into 2010.

And the /Launch function, which allows PDF documents to run embedded executable files, is currently being exploited by attackers in a widespread malicious message campaign that tries to trick users into opening a rigged PDF.

Sullivan spelled out his case in more detail in a post to the F-Secure security blog on Thursday. "Your customers are tired of the exploits and the complications that so many of today's PDF readers include," said Sullivan in a "Dear Microsoft" missive.

"They should write a really simplified viewer, one that just previews PDF," Sullivan added Friday in a telephone interview. "They don't even need to build it into the operating system. They can make it an optional download like they did the 'Save As PDF' add-in for Office."

Although Microsoft intended to add support for saving documents in the PDF file format to Office 2007, it was forced to backtrack when Adobe balked. Instead, Microsoft built a "Save as PDF" add-on that it made available free of charge. After Adobe submitted the PDF/A specification to the ISO (International Organization for Standardization) in 2008, Microsoft added "Save As PDF" support to its suite with the release of Office 2007 Service Pack 2 (SP2) a year ago. The same feature is available in Office 2010.

Office cannot open PDF documents without third-party software or add-ons, however. Windows 7's and Windows Vista's preview feature also won't display PDFs. Instead, Microsoft has promoted, with little success, a substitute for PDF dubbed XPS (XML Paper Specification); an XPS viewer is bundled with Windows 7, for example.

"The PDF specification has been completely royalty-free since 2006," said Sullivan, noting that Microsoft would not have to pay Adobe if it did craft a viewer of its own. "There's no reason why it can't create a native PDF viewer. It could even let users toggle it on and off, if it [were] worried about antitrust [issues]."

Several times, Sullivan compared his vision of a Windows PDF viewer to Preview, the application that Apple includes with Mac OS X. But Preview is not bug free: In March, researcher Charlie Miller said he'd found more than 60 PDF files on the Web that could be used to crash and likely exploit Preview.

Even so, Sullivan argued that Microsoft, or failing that, Adobe itself, should develop a stripped-down PDF viewer that omitted the functionality and features hackers have exploited. "I wish Adobe would create two different versions of Reader, one maybe 'Reader Lite' that's really just a viewer," he said.

Microsoft fixes bug in Producer software

IDG News Service - Microsoft has released a new version of its Producer software, fixing a critical security problem that plagued the product for several months.

Producer is a free add-on tool that helps users capture and add multimedia components to their PowerPoint presentations.

Last March, Microsoft warned of a critical security bug in the product, but it didn't release a new update. Instead, it said that Producer 2003 users should simply uninstall their software. On Monday, however, it posted an update, and is now recommending that "all customers using Producer 2003 upgrade to the new version," according to a blog post from the Microsoft Security Response Center.

Back in March, Microsoft said it was not updating Producer 2003 because it wasn't designed for automatic updates. "Based on our investigation, we determined that the best way to protect the vast majority of customers was to release an update addressing the components that shipped with Windows," Microsoft said in a blog post. "We recommend that customers either uninstall the application or apply an available Microsoft Fix It to disassociate the project file type from the application to add an extra layer of security."

The flaw, which has to do with the way Producer reads certain file formats, also affects Windows Movie Maker. But Microsoft issued a Movie Maker patch when it first warned of the issue in March. A similar product, Windows Live Movie Maker -- which runs on Vista and Windows 7 -- is not affected by the issue.

Microsoft doesn't know of anyone exploiting the bug in online attacks, but it's worried that hackers might be able to use it to install unauthorized software on victims' computers.

"Producer 2003 was a little-known product," said Andrew Storms, director of security operations with security vendor nCircle, via instant message. "What we have is the official replacement for the flawed product."