The vulnerability is identified as APSA10-05 (CVE-2010-3654) and has been confirmed in

• Flash Player 10.1.85.3 and earlier versions for Windows, Mac, Linux and Solaris
• Flash Player 10.1.95.2 and earlier versions for Android
• authplay.dll component which is included in Reader 9.4 and Acrobat 9.4 and earlier 9.x versions

Adobe has confirmed that “This vulnerability could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild against Adobe Reader and Acrobat 9.x.”

Adobe has suggested a temporary fix by deleting, renaming or moving the authplay.dll file but this may cause the application to crash (non-exploitable) or error message when opening a PDF file that contains Flash (SWF) content.

Adobe Systems are expected to release an update for Flash Player by 9th November 2010 and an update for Reader and Acrobat by 15th November 2010.

Read Adobe’s Security bulletin on this vulnerability at http://www.adobe.com/support/security/advisories/apsa10-05.html

The news appeared at http://www.esecurityplanet.com/news/article.php/3910716/Adobe-Warns-of-Another-Critical-PDF-Vulnerability.htm

Post from: 4x PDF Blog

Adobe acknowledges another critical PDF Vulnerability

No related posts.

PDF2ID converts a PDF into a fully-editable InDesign file recreating the intended construction and layout of the document. PDF2ID eliminates the need for any additional PDF data recovery tools and this enhances workflow automation and provides huge cost savings. PDF2ID seems to be the only PDF Converter available in market for InDesign documents.

PDF2ID v3.0 enables the conversion of variable page-size PDFs and provides new options to control the graphics. The new version also identifies the text frame-wrapping around graphical objects to ensure better accuracy in layout and resulting InDesign document.

A summary of new features in PDF2ID v3.0 is below:

• Integration with Adobe InDesign CS5
• Support for variable page-size PDFs
• Linking of Frames across different pages
• Separation of Text, Graphics and Tables into separate layers
• New Options panel for handling Graphics
• Interactive PDF properties

The Standard license of PDF2ID v3.0 is priced at USD 299.00 while the Professional version is priced at USD 399.00. The upgrade from PDF2ID v1.x or v2.x is priced at USD 129.00 and USD 159.00 for Standard and Professional licenses respectively.

The press release appeared at http://news.thomasnet.com/fullstory/PDF-Conversion-Software-creates-accurate-InDesign-documents-583779

Post from: 4x PDF Blog

Recosoft announces newer version of PDF Converter

No related posts.

CEBX allows to store entire document data in a single CEBX file and is compatible with PDF. Apabi Technology claims CEBX technology is superior to PDF. CEBX technology is designed to integrate with various smartphones, handheld e-book readers and tablet computers. The company offers CEBX technology in three different software packages which includes:

1. Apabi Reader – an equivalent to Adobe Reader and enables users to view the documents with no editing capabilities
2. Apabi Marker – a tool to convert other document formats to CEBX
3. Apabi Carbon – a full-featured CEBX editing suite

Beijing Founder Apabi Technology is a leading player in China’s e-book market and has contracts with more than 500 Chinese publishers. The company has also announced a strategic cooperative agreement with China’s Science Press to provide Apabi’s products in 18 different subject categories and more than 8,000 e-books.

Read more on CEBX technology at http://www.apabi.cn/English/index_en.html

The news appeared at http://www.informationweek.com/news/windows/microsoft_news/showArticle.jhtml?articleID=225702186

Post from: 4x PDF Blog

Chinese e-book Player challenges PDF

No related posts.

PDF Stamps, as seen on the video, enable users to place digitally created stamp marks on documents similar to ordinary rubber stamps. However, users can also automate and make interactive stamps using PDF scripts. Example features highlighted on the video are the capability of users to customize buttons which when used, automatically stamp a digital signature of the current user complete with the company logo,  date and time the document was stamped.

To see this video, click here: http://www.pdfscripting.com/public/images/Video/PDFStampsGoneWild.cfm

Post from: 4x PDF Blog

PDFScripting.com releases introductory video of PDF Stamps

No related posts.

Kaspersky Lab’s report also showed that of the top ten software vulnerabilities identified on most infected users come from Adobe products including Adobe Reader and Adobe Acrobat both accessing files in PDF formats.

News source: http://www.abs-cbnnews.com/lifestyle/gadgets-tech/06/12/10/adobe-hackers-favorite-1st-quarter-2010

To view the complete Kaspersky Lab Report, go to http://www.securelist.com/en/.

Post from: 4x PDF Blog

Adobe on top of the list of virus attackers favorite in Q1 2010

No related posts.

The attackers could exploit the latest bug to hijack the targeted computer through the compromised “authplay.dll” file packaged with every installation of Reader and Acrobat. The temporary fix is to rename or delete this file and it will work for Reader and Acrobat but this temporary fix does not work for Flash Player causing it to crash.

Adobe will patch this critical bug for Flash Player but the fix for Reader andAcrobat will be bundled with the impending patch which was earlier scheduled for 13th July. This previously planned patch will now be brought forward to 29th June to include the fix for the latest bug.

Read more details on http://www.computerworld.com/s/article/9177811/Adobe_delays_Reader_patch_as_attacks_spread_exploit_code_goes_public?taxonomyId=82

Post from: 4x PDF Blog

Adobe delays security patches for Reader and Acrobat

No related posts.

As part of this agreement, Adobe will transition development and support of its 3D SDK and related technologies, associated employees and other related resources to Tech Soft 3D. Adobe will continue to support 3D data within its applicable products, including Adobe Reader software. Tech Soft 3D will continue to develop latest CAD translators and provide it to end users as plug-ins for Adobe software for reading and producing output in 3D PDF.

Adobe’s 3D SDK consists of 3D CAD translation suite and Software development kit for PDF publishing. Adobe 3D SDK enables OEM development teams to create applications that access data from around 25 commonly used 3D file formats and translate the content into 3D PDF files based on industry-accepted standards such as PRC and U3D formats.

On completion of this transaction, Tech Soft 3D will continue to update, enhance and support 3D technologies from its development center in Lyon, France. Tech Soft 3D also plans to repackage the 3D SDK and PRC Publisher into a pure library form for easier integration with other products and applications.

The press release appeared at http://www.marketwatch.com/story/tech-soft-3d-reaches-agreement-with-adobe-to-develop-adobe-3d-sdk-technology-2010-05-24?reflink=MW_news_stmp

Post from: 4x PDF Blog

Tech Soft 3D signs agreement with Adobe to develop and distribute 3D SDK

No related posts.

Adobe Reader for Android offers various features such as multi-touch navigation functions such as pinch-and-zoom and double-tap-zoom, flick-scrolling and panning. It also features ”reflow” mode which automatically wraps the content of text-heavy documents with wide margins for easy viewing on smaller screens of handheld devices.

Adobe Reader for Android is now available for free from Adobe. Adobe has also published a FAQ on Adobe Reader for Android which can be accessed at http://www.adobe.com/products/reader/pdfs/android_FAQ.pdf

The minimal system requirements for Adobe Reader are

• Android v2.1
• 550MHz processor
• 256MB RAM
• 4.3MB available disk space

Steve Gottwals also listed the Android devices that have been tested for Adobe Reader and are supported. These devices include Motorola Droid, Motorola Milestone and Google Nexus.

The news appeared on the Adobe Reader Blog at http://blogs.adobe.com/adobereader/2010/05/introducing_adobe_reader_for_a.html

Post from: 4x PDF Blog

Adobe Reader now available for Android

No related posts.

PDF Print Engine 2.5 provides an end-to-end workflow for PDF publishing and is based on Adobe technologies. It uses Creative Suite for authoring, Acrobat or Reader for validation and sharing, and PDF Print Engine for final output. PDF Print Engine 2.5 also enables high rendering speed and workflow for graphically complex and personalized effects such as variable transparency by enabling repeating elements to be intelligently cached.

PDF/VT is expected to be an international standard (ISO 16612-2) and as PDF Print Engine 2.5 uses PDF/VT, it will enable exchange of VDP jobs and promote efficient collaboration among enterprises, marketers, designers and printers.

Several OEM partners to Adobe are expected to announce new products built on Adobe PDF Print Engine 2.5. The announcement on new products are expected at IPEX 2010, a global trade event for printing and publishing, on 18-25 May in Birmingham (UK).

The news appeared at http://www.wide-formatimaging.com/web/online/Products/Adobe-Announces-PDF-Print-Engine-25/5$5960

Post from: 4x PDF Blog

Adobe launches PDF Print Engine 2.5

No related posts.

Adobe has recently introduced its Adobe Approved Trust List (AATL) to automatically enable trust for certificate issuers that adhere to stringent operational and issuance standards. The AATL’s automatic updates enables users to check the validity of digital certificates and the integrity of digitally signed PDFs.

QuoVadis’ Digital certificates included in AATL and automatically trusted by Adobe products are

1. QuoVadis Advanced+ Certificates, which includes QuoVadis Swiss ElDI-V and GeBüV certificates and QuoVadis Bermuda Accredited certificates
2. QuoVadis Qualified Certificates, which includes QuoVadis Swiss ZertES Qualified certificates, QuoVadis SuisseID certificates and QuoVadis Dutch Qualified certificates
3. QuoVadis PKI Overheid certificates

QuoVadis provides identity services including Public Key Infrastructure (PKI), Digital Certificates, SSL Certificates, Time-stamping and Root Signing for internal PKI.

Read more on products from QuoVadis at http://www.quovadisglobal.bm/

The news appeared at http://www.royalgazette.com/rg/Article/article.jsp?articleId=7da58a730030018&sectionId=65

Post from: 4x PDF Blog

QuoVadis Digital Certificates in Adobe Approved Trust List

No related posts.

APPE uses the same core imaging technologies as industry-leading Adobe applications and it effectively streamlines the hand-off between job creator and printer. APPE delivers greater colour consistency and workflow flexibility by processing native PDF files without conversion to PostScript. APPE also uses JDF-based automation technologies, an XML-based file technology used as an electronic job ticket, for greater overall throughput.

The combination of Xerox EX Print Server and APPE accurately renders the most complex designs and maintains the integrity of jobs throughout the entire workflow. The Xerox Color 800/1000 presses, printing 80- and 100-pages per minute respectively, produces high-definition quality of image on a wide range of paper stock and also, includes an optional clear dry ink station to amplify full-colour jobs.

The news release appeared at http://www.graphicrepro.co.za/asp/news_long.asp?nid=15544

Post from: 4x PDF Blog

Enhanced Adobe PDF Print Engine now available for Xerox’s new colour presses

No related posts.

ODX/3DPDF enhances the ability of Independent Software Vendors (ISVs) to provide 3D PDF output from their graphical user interfaces. CCE has also enhanced its Oceans SDK (OSDK) software, its middleware technology, with an ability to export 3D PDF files. The enhanced Oceans SDK will allow export of 3D PDFs from CAD data stored in PDM/PLM systems without any dependency on the Adobe suite of products.

CCE specializes in CAD software development toolkits for CAD ISVs and also for use in its own data translator & viewer products. Applications developed using CCE’s ODX/3DPDF or OSDK are completely independent of any form of CAD software or licensing.

The press release can be read at http://pr-usa.net/index.php?option=com_content&task=view&id=375687&Itemid=34

Post from: 4x PDF Blog

New API to generate 3D PDFs from Native CAD

No related posts.

The key difference between Adobe’s existing and new update technology is that the latter would update the software in the background without additional notification or permission from the user. The existing update technology alerts the users on the availability of patches but leaves it to the discretion of users to install the patches. Hence, the new update technology would ensure that more and more users are fully-patched and covered for any known PDF vulnerabilities.

Adobe also intends to reduce the interval between regular updates from seven days to three days.

Adobe has recently been swarmed with numerous vulnerabilities and attacks on PDF documents. As per one of the studies, PDF vulnerabilities were responsible for nearly 80% of exploits in 2009.

The news appeared at http://www.computerworld.com/s/article/9175043/Adobe_to_switch_on_silent_PDF_updates_for_Reader_Acrobat

Post from: 4x PDF Blog

Adobe to enable silent PDF updates for Reader and Acrobat

No related posts.

The workaround was posted on a blog by Adobe’s Product Manager, Steve Gottwals and Steve suggests to alter a Registry settings on Windows or grey-out a PDF preference which would stop users from turning on or launching the embedded content. The change in settings could be done by the System administrators.

In the meantime, Adobe is evaluating the best-suited way forward to push such workarounds through the Product updates.

Read Adobe’s blog on this workaround at http://blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_function.html

The news appeared at http://www.zdnet.co.uk/news/security-threats/2010/04/08/adobe-offers-workaround-for-pdf-risk-40088569/?s_cid=938

Post from: 4x PDF Blog

Adobe proposes workaround to avoid PDF hacks

No related posts.

Conway’s proof of concept does by by showing two files: 1) an “empty.pdf” file, and 2) an evil “ownit.pdf” which contains the malware. When he opens the “ownit.pdf” file, he then clicks “Open” on the displayed dialog, after which the original “empty.pdf” file now also contain the malware.

You can see the Conway’s video here

Note: two things;  according to Stevens and Conway, this does weakness is based around the PDF specification itself not the Adobe Reader; the attack itself requires the user to click through a dialog — as such, a form of ‘social engineering’ would be required by the attacker, i.e. the message displayed to the user would have to make clicking ‘open’ a reasonable thing to do — certainly something like ‘would you like a worm?’ — wouldn’t be such a note…

An Adobe spokeswoman replied Monday night to both Stevens and Conway’s posts with: “Users can also turn off this functionality in the Adobe Reader and Adobe Acrobat Preferences by selecting > Edit > Preferences > Categories > Trust Manager > PDF File Attachments and clearing the box ‘Allow opening of non-PDF file attachments with external applications.’”

At the moment, the Foxit Reader does not display any such dialog to the user although the Foxit team say that they are working on this process.

Source of Information [http://news.cnet.com/8301-27080_3-20001792-245.html]

Post from: 4x PDF Blog

Watch out for the wriggling PDF worm!

No related posts.