0

For Adobe Reader's Protected-Mode, I'm using a policy exception of FILES_ALLOW_READONLY, and I'm wondering if it is a reasonable security risk?

I'm using an Adobe Reader Javascript program to save and restore open tabs: Adobe Acrobat Reader Tabs Saving And Autoloading

This program does not work for some pdf files, due to Acrobat Reader's default Protected-Mode policies. In the program's LoadTabs function, app.openDoc fails for some files, e.g. files under c:\users\myUserid

The default Protected-Mode policies are here: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/protectedmode.html

The problem can be bypassed by turning off Protected Mode, but that seems too risky. (Preferences -> Security (Enhanced) -> "Enable Protected Mode at startup")

A less risky solution is to create a policy file, with the rule: FILES_ALLOW_READONLY=c:\users\myUserid\*

For a typical workstation, is this rule a reasonable risk?

EDIT: I later read this in the Protected-Mode policy specs (link is above), "In 11.0, Reader’s Protected Mode does prevent the sandbox from reading arbitrary files in these locations [(e.g., MyDocuments)]. This enhancement [in 11.0] makes it harder for malicious PDFs to steal user’s confidential information."

So, my use of FILES_ALLOW_READONLY creates a vulnerability that potentially allows malicious PDFs to steal info under c:\users\myUserid\*

It appears the vulnerability can be reduced by disabling Acrobat Javascript as described at this link. https://helpx.adobe.com/acrobat/using/javascripts-pdfs-security-risk.html

After disabling Acrobat Javascript, the tab Javascript functions still work. However, I don't know how much the vulnerability is reduced, or how much usability will be negatively affected.

Regarding whether that rule is a reasonable risk depends on the likelihood of the vulnerability being exploited. How likely is such an exploit, for a typical workstation?

cuttingBait
  • 1
  • 2

1 Answers1

0

There's no need to turn Protected Mode off or use a policy exception. Instead, in that same dialog, you can add a local folder to the list of Privileged Locations. Files in these locations are considered trusted and are not subject to the security restrictions.

joelgeraci
  • 4,606
  • 1
  • 12
  • 19
  • I tried specifying the directory in the list of Privileged Locations, but it seemed to only provide access to files in that directory, and not to files in sub-directories beneath that directory. Using FILES_ALLOW_READONLY does allow access to the specified directory, and all directories below it. However, my question is not how to grant access, but whether granting such access is a reasonable security risk. – cuttingBait Jul 20 '17 at 18:41
  • So... that code uses the global object. The behavior of the global object changed after Acrobat 9. For it to work, I think you would have had to turn off the global object security policy. That alone introduces more risk than I'd personally be comfortable with. – joelgeraci Jul 20 '17 at 19:29