Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 89782 - Adobe Reader 7.0 contains spyware feature turned on by default
Summary: Adobe Reader 7.0 contains spyware feature turned on by default
Status: RESOLVED DUPLICATE of bug 87445
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Gentoo Security
URL: http://lwn.net/Articles/129729/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-04-20 03:33 UTC by Jakub Moc (RETIRED)
Modified: 2005-07-17 13:06 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jakub Moc (RETIRED) gentoo-dev 2005-04-20 03:33:15 UTC
<snip>
Remote Approach's reporting did not work when we viewed the document with Kpdf, Xpdf and Adobe Reader 5.0.10. It also failed using Apple's "Preview" application on Mac OS X. The document was still viewable with no apparent glitch in other PDF readers, but the reporting function did not work. However, when we opened the file using Adobe Acrobat Reader 7, Remote Approach started logging views from our IP address. After doing a little research, we found that Adobe's Reader was connecting to http://www.remoteapproach.com/remoteapproach/logging.asp each time we opened the document. The information is submitted over port 80 using HTTP, so it is unlikely that a home or office firewall would, in a normal configuration, block the activity, unless the firewall administrator is attempting to block Web browsing.

Apparently, Remote Approach's "tag" to our document included the addition of JavaScript code causing Acrobat to report back to their server; the information reported includes the fact that the document had been read, our IP address, and which viewer it had been read in. (Interestingly, Remote Approach does not seem to recognize the Linux version of Acrobat Reader, as it left the "User Agent" field blank in its reports.) 
</snip>

<snip>
By default, Adobe Reader 7 turns on JavaScript, so the "tagged" document is able to "phone home" without the user's awareness. Turning off JavaScript disables the document's code, and prevents Remote Approach (or any other entity) from tracking views of the document. No doubt, Remote Approach is using features that would normally be used to submit information from a PDF form.
</snip>

Hmm. :-(

Reproducible: Always
Steps to Reproduce:
Comment 1 Tavis Ormandy (RETIRED) gentoo-dev 2005-04-20 03:37:43 UTC

*** This bug has been marked as a duplicate of 87445 ***
Comment 2 Jakub Moc (RETIRED) gentoo-dev 2005-04-20 03:40:02 UTC
Sorry for dupe, did search for "adobe" instead of "acroread"... :/