Adobe Reader 11 (XI) released, new security tweaks

[mechBgon]

Adobe Reader 11, or XI in Roman numerals, is available from Adobe's site, or I usually get it from their FTP site at ftp://ftp.adobe.com/pub/adobe/reader

For the Windows version, Adobe has improved their sandbox, which was already a real security game-changer in version 10. They've also used ForceASLR to enforce the use of Address Space Layout Randomization on any .DLL that Reader loads, which makes exploitation more difficult.

I installed Reader and disabled Adobe JavaScript as usual. That setting is found by clicking Edit > Preferences, then choosing JavaScript in the Preferences sidebar and unchecking the box, like so:

This feature has historically been abused to launch Flash exploits from PDFs, and I think most of us will not be impacted by having it disabled.


I also hit the Security (Enhanced) panel, and set Reader to always open stuff in Protected View:

This puts extra constraints on PDF content in case it's malicious.


On the topic of security: ASLR works in conjunction with Data Execution Prevention (DEP), so make sure your system's set to enforce DEP on all software (which is not the default setting). An easy way to do that is to install Microsoft EMET and configure it, which I have some guidance on here: http://www.mechbgon.com/build/security2.html#sehop EMET is an anti-exploitation package with little performance impact, definitely worth having.

 

[TJCS]

Thanks for the security tips on the reader mechbgon! I will definitely update these on my folk's machines.

 

[Chiefcrowe]

Thank you for letting us know. I installed it and it does seem faster, and security enhancements are always welcome!

Also just read this article which explains it further:

https://www.computerworld.com/s/art...ters_Reader_Acrobat_XI_security?taxonomyId=18

 

[mechBgon]

I forgot to mention this, but the security settings are on a per-user basis (on Windows, dunno about other OSes), so if the computer has multiple user accounts, set your desired security settings from each Windows account.

 

[shadow_k]

Which is better Foxit Reader or this? The only good thing about Foxit Reader is that it uses so little resources.

 

[mechBgon]

AFAIK Foxit doesn't have the sandbox, while Adobe is now into their 2nd-generation sandbox here, and has Protected View as well, plus ForceASLR now. So I think Adobe has the better security mitigations package right now.