Comments on: Quickpost: /JBIG2Decode “Look Mommy, No Hands!” http://blog.didierstevens.com/2009/03/09/quickpost-jbig2decode-look-mommy-no-hands/ (blog 'DidierStevens) Fri, 12 Mar 2010 08:07:51 +0000 http://wordpress.com/ hourly 1 By: ψ² = Ps(i)² » Blog Archive » Wer hat an der Uhr gedreht… http://blog.didierstevens.com/2009/03/09/quickpost-jbig2decode-look-mommy-no-hands/#comment-35108 ψ² = Ps(i)² » Blog Archive » Wer hat an der Uhr gedreht… Wed, 10 Jun 2009 09:20:30 +0000 http://blog.didierstevens.com/?p=1281#comment-35108 [...] Stevens schreibt “Look mommy, no hands“, und meint damit, dass er ohne Zutun des Opfers mit einer manipulierten PDF-Datei einen [...] [...] Stevens schreibt “Look mommy, no hands“, und meint damit, dass er ohne Zutun des Opfers mit einer manipulierten PDF-Datei einen [...]

]]> By: Poken Peek « Didier Stevens http://blog.didierstevens.com/2009/03/09/quickpost-jbig2decode-look-mommy-no-hands/#comment-34409 Poken Peek « Didier Stevens Thu, 26 Mar 2009 07:35:56 +0000 http://blog.didierstevens.com/?p=1281#comment-34409 [...] Encryption, My Software, RFID — Didier Stevens @ 7:35 OK, after getting side-tracked by /JBIG2Decode PDFs, let’s get back on the smartcard and RFID [...] [...] Encryption, My Software, RFID — Didier Stevens @ 7:35 OK, after getting side-tracked by /JBIG2Decode PDFs, let’s get back on the smartcard and RFID [...]

]]> By: Dominic White http://blog.didierstevens.com/2009/03/09/quickpost-jbig2decode-look-mommy-no-hands/#comment-34367 Dominic White Tue, 17 Mar 2009 11:20:03 +0000 http://blog.didierstevens.com/?p=1281#comment-34367 <strong>SA AV Vendor Recycling News for FUD Marketing...</strong> ClassicFM just phoned me for comment on this story. I did some quick research and was rather dismayed to find that this appears to be an attempt to drum up some press references for marketing rather than a responsible informing of the public.It was ref... SA AV Vendor Recycling News for FUD Marketing…

ClassicFM just phoned me for comment on this story. I did some quick research and was rather dismayed to find that this appears to be an attempt to drum up some press references for marketing rather than a responsible informing of the public.It was ref…

]]> By: Adobe parchea a medias su vulnerabilidad casi un mes después, mientras Foxit Reader lo soluciona en - Foro de Informatica - Foro de Windows 7, Windows Vista y Noticias de informatica http://blog.didierstevens.com/2009/03/09/quickpost-jbig2decode-look-mommy-no-hands/#comment-34357 Adobe parchea a medias su vulnerabilidad casi un mes después, mientras Foxit Reader lo soluciona en - Foro de Informatica - Foro de Windows 7, Windows Vista y Noticias de informatica Fri, 13 Mar 2009 11:21:06 +0000 http://blog.didierstevens.com/?p=1281#comment-34357 [...] [...] [...] [...]

]]> By: Nick http://blog.didierstevens.com/2009/03/09/quickpost-jbig2decode-look-mommy-no-hands/#comment-34350 Nick Thu, 12 Mar 2009 16:52:56 +0000 http://blog.didierstevens.com/?p=1281#comment-34350 Kuba, you are correct. That will handle the AcroRdIF.dll and AcroRd32.dll still cached. What other processes still have some part of reader cached? Who knows. You could search to see who still has it loaded, or you could just restart and not worry about it. Also, another interesting tidbit. There are tips out there about unregistering AcroRdIF.dll and PDFShell.dll. These work great; that is, until acrobat reader detects what you have done and reconfigures itself on next launch (it may not detect this til you next restart windows). At this point, it reregisters the DLLs, and also changes the windows registry so that pdf files will again automatically open when browsed to in internet explorer. Acrobat Reader is pervasive enough that it should have a "secure" install mode. No shell extensions, no IFilters, no web browser integration, no javascript. Do the one thing people actually want... open PDFs... and do it well without being a severe security liability. Kuba, you are correct. That will handle the AcroRdIF.dll and AcroRd32.dll still cached. What other processes still have some part of reader cached? Who knows. You could search to see who still has it loaded, or you could just restart and not worry about it.

Also, another interesting tidbit. There are tips out there about unregistering AcroRdIF.dll and PDFShell.dll. These work great; that is, until acrobat reader detects what you have done and reconfigures itself on next launch (it may not detect this til you next restart windows). At this point, it reregisters the DLLs, and also changes the windows registry so that pdf files will again automatically open when browsed to in internet explorer.

Acrobat Reader is pervasive enough that it should have a “secure” install mode. No shell extensions, no IFilters, no web browser integration, no javascript. Do the one thing people actually want… open PDFs… and do it well without being a severe security liability.

]]> By: Kuba http://blog.didierstevens.com/2009/03/09/quickpost-jbig2decode-look-mommy-no-hands/#comment-34348 Kuba Thu, 12 Mar 2009 09:54:36 +0000 http://blog.didierstevens.com/?p=1281#comment-34348 "Explorer still has AcroRdIF.dll and AcroRd32.dll loaded. You MUST RESTART your PC." Nope. Ctrl-Alt-Del, kill Explorer, start Explorer again. What's all this rebooting, anyway? “Explorer still has AcroRdIF.dll and AcroRd32.dll loaded. You MUST RESTART your PC.”

Nope. Ctrl-Alt-Del, kill Explorer, start Explorer again. What’s all this rebooting, anyway?

]]> By: Adobe schließt kritische Lücke in Reader und Acrobat | Tiger Eye Books http://blog.didierstevens.com/2009/03/09/quickpost-jbig2decode-look-mommy-no-hands/#comment-34347 Adobe schließt kritische Lücke in Reader und Acrobat | Tiger Eye Books Thu, 12 Mar 2009 09:13:51 +0000 http://blog.didierstevens.com/?p=1281#comment-34347 [...] wurde bekannt, dass unter Windows ein Anwender unter Umständen nicht einmal ein präpariertes Dokument selbst [...] [...] wurde bekannt, dass unter Windows ein Anwender unter Umständen nicht einmal ein präpariertes Dokument selbst [...]

]]> By: Adobe Acrobat Reader 9 Update veröffentlicht! « Joerg´s IT-Tech Blog http://blog.didierstevens.com/2009/03/09/quickpost-jbig2decode-look-mommy-no-hands/#comment-34344 Adobe Acrobat Reader 9 Update veröffentlicht! « Joerg´s IT-Tech Blog Wed, 11 Mar 2009 19:15:13 +0000 http://blog.didierstevens.com/?p=1281#comment-34344 [...] wurde bekannt, dass unter Windows ein Anwender unter Umständen nicht einmal ein präpariertes Dokument selbst [...] [...] wurde bekannt, dass unter Windows ein Anwender unter Umständen nicht einmal ein präpariertes Dokument selbst [...]

]]> By: Critical Adobe Reader update - Upgrade NOW! | IT a digital life http://blog.didierstevens.com/2009/03/09/quickpost-jbig2decode-look-mommy-no-hands/#comment-34343 Critical Adobe Reader update - Upgrade NOW! | IT a digital life Wed, 11 Mar 2009 16:17:29 +0000 http://blog.didierstevens.com/?p=1281#comment-34343 [...] your users as soon as you can because this is a nasty one.  Users who download a malicious PDF do not need to open it to fall victim to that [...] [...] your users as soon as you can because this is a nasty one.  Users who download a malicious PDF do not need to open it to fall victim to that [...]

]]> By: Eric Jacksch http://blog.didierstevens.com/2009/03/09/quickpost-jbig2decode-look-mommy-no-hands/#comment-34342 Eric Jacksch Wed, 11 Mar 2009 13:11:35 +0000 http://blog.didierstevens.com/?p=1281#comment-34342 Thanks for the solid info -- I linked to you from my article for the TECHLife Post. Thanks for the solid info — I linked to you from my article for the TECHLife Post.

]]>