Foxit Reader

Acrobat Reader Users Should Switch to Foxit Reader, Shrink Their Attack Surface

I’m not going to rant, I promise–I don’t have to because this doesn’t affect me. Several years ago, I abandoned the bloated, insecure and extremely resource-intensive Acrobat Reader in favor of the smaller and more secure Foxit Reader. Once again, here is more evidence that I’m right to have switched.  Brian Krebs of The Washington Post wrote:

No! Don’t update. Shrink your attack surface and switch to Foxit Reader and their other PDF software. Not only are Foxit Software’s products more secure, they’re also cheaper.

Foxit Reader Contains Multiple Vulnerabilities

According to a U.S. Cert bulletin issued today, my favorite PDF reader, Foxit Reader has multiple security vulnerabilities:

Foxit Reader has released updates for multiple vulnerabilities. By convincing a user to open a malicious PDF file, an attacker may be able to execute code or cause a vulnerable PDF viewer to crash. The PDF could be emailed as an attachment or hosted on a website.US-CERT encourages users to review the Foxit Security Bulletin and Vulnerability Note VU#251793 and apply any necessary updates.

The Foxit Security Bulletin describes the issues:

Two Security Vulnerabilities Fixed in Foxit Reader 3.0 and JPEG2000/JBIG2 Decoder

SUMMARY
Here is detailed information about the vulnerabilities:

1. Fixed a problem related to negative stream offset (in malicious JPEG2000 stream) which caused reading data from an out-of-bound address. We have added guard codes to solve this issue.
2. Fixed a problem related to error handling when decoding JPEG2000 header, an uncaught fatal error resulted a subsequent invalid address access. We added error handling code to terminate the decoding process.

I recommend that all Foxit Reader users update their Foxit Reader 3.0, available here: http://www.foxitsoftware.com/downloads/. Then, be sure to go to Help>Check for updates and download the stream decoder update.