LFI to RCE via access_log injection

How the open-source #community should respond to #Adobe pulling #Linux support


This is probably old news for many TechRepublic member. However, for those of you who donot know, Adobe has pulled Reader from the hands of the Linux faithful. If you visit the Adobe site, you'll see that the Linux platform is no longer listed in their supported downloads (Figure A).
Figure A
Figure A
Linux is no longer a supported platform for Adobe Reader.
So, what's the big deal? Adobe has clearly shown it has zero interest in supporting our platform of choice. This is not new news. In fact, Reader hadn't been updated for Linux since May, 2013. And what about the rest of Adobe products? Need I say more? And Reader for Linux has been in a pathetic state for a long time (even the Windows version is a mess). There are also other, better alternatives for Linux (such as Evince and Ocular).
But ...

The real issue

Here's the big issue. There are a lot of government entities making a major shift to the Linux platform. Most of those entities and agencies actually use PDF documents -- many of which are Adobe with embedded forms that can't be used with those default Linux PDF viewers. This is going to cause a major issue for a lot of very large organizations (think government agencies and institutions of higher learning). When people can't use official government documents on their chosen platform, things will come unravelled very quickly. Something must be done.
That something will not be Adobe supporting Linux. They have dug that grave, made that bed, fried that bacon. No matter how much public outcry, Adobe is simply one of those companies that has no desire to support Linux and open source. Remember, this is the same company that stopped providing official Flash builds in 2012. Yes, this is a huge mistake on the part of Adobe. The Linux faithful will refuse to support the company in every way they can. But there's one thing the Linux community must do in order to overcome this real and imminent setback:
Support the necessary features needed for government agencies to continue working with PDF documents.
This is going to be a problem. Why? Most governments use the extended PDF functionality to fill out paperwork -- functionality found in Adobe, not Evince or Ocular. What's odd about this is that the full PDF spec is available to download. Even the XML Forms Architecture spec is available. But then there's the embedded JavaScript issue. This is one Adobe PDF feature that no Linux PDF app has any plans to support (partially because of security risks). Additionally, no native Linux PDF reader supports the following:
  • Animation
  • Extended form filling
  • Subpixel rendering
  • Embedded 3D models
You see how the problem has spun out of control?
The PDF document is long in the tooth. It's insecure, and (on many platforms) it can bring the desktop to a crawling halt. This is yet another layer to an already daunting issue -- depending on outdated technology. When there's a clear and better replacement available (HTML5), why should we even consider backpedaling and not moving forward? Because too many people, institutions, and agencies are too deeply mired in that which is the Adobe PDF document to separate quickly and seamlessly.
That inability to move forward will cause major hurdles for Linux. Something must be done. Ideally, that something would be to create a new (open) standard for these documents, based on HTML5 -- something everyone could use with a modicum of security and reliability. The open-source community needs to come out swinging with a replacement for PDF that is light years ahead of the current fiasco and show Adobe that they aren't playing around. There is way too much talent in the ever expanding pool of open-source developers for this not to happen. They key factor will be to create it and release it for everyone... all platforms, desktop, and mobile. Do not give companies like Adobe the opportunity to cannibalize the creation and close it up.
It's time to get rid of those "Must be viewed by Adobe Reader" buttons everywhere. Instead of cowering in a corner, hoping someone will resolve the problem before the Linux desktop is forced back to square one (which they may not be able to ever leave), the open-source community needs to come together and create the next document format that is truly portable (instead of "profitable").
Do you think the open-source community can pull off such a feat? Or is the world too dependent on the current state of PDF to change? Let us know your thoughts in the discussion thread below.


Comments