If you haven’t heard already, there is a buffer overflow attack in the wild that exploits the fully-patched and latest versions of Adobe Acrobat and Adobe Reader, 8.3 and 9.0. The exploit can come in the form of opening a malicious or poisoned PDF file. You can read more about the specifics of the attack and how it works from an article at The Register. To summarize the problem, Javascript inside of a PDF can allow for code to be run on your computer. Variants of the exploit exist including one that installs a trojan virus and could allow a malicious user remote control over the computer.
Adobe plans to release a patch on March 11th to address the issue. In the meantime, to prevent the exploit from getting a foothold you can disable Acrobat JavaScript from within Adobe Reader and Acrobat. To do this go to Edit, Preferences… Then in the left-pane, navigate to JavaScript. The right-side of the window will update to JavaScript preferences. You should uncheck “Enable Acrobat JavaScript.” Even without this specific exploit, JavaScript should arguably be disabled anyways.
Fortunately for us, this setting is made in the registry. That means we can script it in any instance where we need to deploy this setting change through our enterprise environment.
If you open RegEdit and go to HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\9.0\JSPrefs, you will see a value named bEnableJS. To disable JavaScript in Acrobat 9.0 set this to a value of 0. To Enable it, set it to a value of 1. Note: If you haven’t changed the JavaScript preferences for Acrobat yet, this key will not exists.
Execute this command on a computer or put it in a logon script to set this registry value and disable JavaScript in Adobe Acrobat 9.0.
reg add "HKCU\Software\Adobe\Adobe Acrobat\9.0\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
Adobe Reader 9.0
You will find similar changes to be made with Adobe Reader 9.0. Go to Edit, Preferences… Under JavaScript, disable Acrobat JavaScript by unchecking the box.
The value in the registry can be found at a similar path:
HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\9.0\JSPrefs
Set the value named bEnableJS to 0 to disable JavaScript.
Execute this command on a computer or put it in a logon script to set this registry value and disable JavaScript in Adobe Reader 9.0.
reg add "HKCU\Software\Adobe\Acrobat Reader\9.0\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
Thanks Adobe! Another reason we didn’t need JavaScript or Flash in our PDFs in the first place.
Related posts:
Dear 404 Tech,
I am Raman, 12 years old.
May I send my question via e-mail for you?
I couldn’t find your e-mail address hear.
Thanks,
sorry for my mistake:
I couldn’t find your e-mail address here.
Hi Raman,
Please post your question here in the comments so that anybody else with the same question might be able to find the answer. This way we can all learn from each other.
I hope I’ll be able to help you. If necessary, you can find my e-mail address on the about 404 Tech Support Page.
Here’s a script to disable JS in all versions that are installed (may be mangled by de-htmlifier..
Logserver commented out. Add back if you want.
Two lines were truncated above. They are wrapped below (you should UNWRAP them)
I used findstr /R “HKEY.*\.0″ instead of find “HKEY”. If I used just ‘find’ then it created JSPrefs key also directly under “Acrobat Reader” key and if run repeatedly then every time new JSPrefs key under “Acrobat Reader\JSPrefs\JSPRefs\…” and so on.
Right, sorry, just saw this. I had fixed by method below (find “Acrobat\” and find “Reader\”). Your fix may be better. Again, lines below will need to be unwrapped.
@echo off & cls
:: Batch file to disable javascript in all versions of acrobat.
echo Searching Registry for Acrobat reader and full Installs
for /f “delims=,” %%I in (‘reg query “HKCU\SOFTWARE\Adobe\Acrobat Reader”‘) do echo %%I | find “Reader\” > nul && call :All-Installations %%I
for /f “delims=,” %%I in (‘reg query “HKCU\SOFTWARE\Adobe\Adobe Acrobat”‘) do echo %%I | find “Acrobat\” > nul && call :All-Installations %%I
echo Search Complete..
goto :EOF
:All-Installations
Rem Update Key
reg add “%*\JSPrefs” /f
reg add “%*\JSPrefs” /f /v bEnableJS /t REG_DWORD /d 0
reg add “%*\JSPrefs” /f /v bConsoleOpen /t REG_DWORD /d 0
reg add “%*\JSPrefs” /f /v bEnableGlobalSecurity /t REG_DWORD /d 1
reg add “%*\JSPrefs” /f /v bEnableMenuItems /t REG_DWORD /d 0
echo –%date% %time%–%username% on %computername% disabled %* >> \\law23\update\LOGS\AcrobatJSDisable.log
goto :EOF