Brad Arkin, Director of Product Security and Privacy here at Adobe talks about the Reader and Acrobat Security Initiative.
Security updates are now available for Adobe Reader and Acrobat. Adobe recommends users of Acrobat and Adobe Reader update their product installations to versions 9.1.1, 8.1.5, or 7.1.2 using the instructions located here to protect themselves from potential vulnerabilities. Adobe expects to make available Adobe Reader 7 and Acrobat 7 updates for Macintosh before the end of June.
UPDATE! - You can chain the updates by following the instructions from my earlier post. To add the 9.1.1 patch, add a semi-colon between the patches. Your patch line should look similar to the one below.
PATCH=AcrobatUpd901_all_incr.msp;AcrobatUpd911_all_incr.msp
Note: For those of you who disabled JavaScript during this window of exposure, these updates correct the vulnerability and you can now re-enable that functionality.
Enable JavaScript in Adobe Reader and Acrobat using the instructions below:
1. Launch Acrobat or Adobe Reader.
2. Select Edit>Preferences
3. Select the JavaScript Category
4. Check the ‘Enable Acrobat JavaScript’ option
5. Click OK
In earlier versions of Acrobat and Reader, certain revoked Digital Signatures that displayed as invalid, now display as valid signatures in Acrobat and Reader 9.1. We've released a new TechNote that describes this change and how you can make a few changes to return to the original behavior of Acrobat 9.0 if you feel the need.
Why the change?
While the signatures may have been deemed invalid in the past by Acrobat, the signature validation time change shows that the signatures actually were valid at the time of signing... but may not be valid today. This is an important distinction which we felt was critical to bring out in 9.1. We feel that signing time is a more accurate portrayal of the status of the signature, rather than current time.
Read the complete TechNote, Certain revoked Digital Signatures which in Acrobat and Reader versions prior to 9.1 displayed as invalid, now display as valid signatures in Acrobat and Reader 9.1. That's the title - seriously.
We've overhauled the security related documentation and web site. Personally, I can't believe how much easier it is to find stuff, you barely need to scroll the browser. Here's a few highlights:
Click Here to go to the Adobe Security and Information Assurance Document Library
Give a man a fish and you feed him for a day. Teach a man to fish and you feed him for a lifetime.
All too frequently I find myself opening my browser, selecting one of my bookmarks, copying the URL and pasting that into an email in response to a customer question. Much of the the information that customers need is available on the Adobe web or in one of our blogs but I'll be the first to admit that even with the best search engine and key word choices it can be hard to find that one bit of information you need. I think there's also a new law requiring that the more urgently you need to find something, the more difficult it is to find.
To help a little, I've created a Delicious account with all of my most commonly referenced links. I'll update this periodically so please add me to your network if you find the links useful.
Add me to your Delicious network
Note: These instructions apply to Acrobat only. The Reader update is delivered as a full installer.
To include the patch into the main installer, you need to make a minor change to the "setup.ini" file. This modification will add the update ".msp" to the installation run by "setup.exe". The additional required line is below in red. The file name is just an example, replace it with the actual file name of your updater. The patch file name given in this example is for 9.0.1, the contents of the "setup.ini" is for EFG Standard. The file name will be different in 9.1 and may vary based on SKU, and the setup.ini file contents may vary based on SKU.
Note that the only changes required are...
Example of setup.ini file (For Acrobat Standard - English, French, & German)
[Startup]
RequireOS=Windows XP
RequireMSI=3.0
RequireIE=6.0.2600.0
CmdLine=/sAll
[Product]
msi=AcroStan.msi
Languages=1033;1031;1036
1033=English (United States)
1031=German (Germany)
1036=French (France)
CmdLine=TRANSFORMS="AcroStan.mst"
PATCH=AcrobatUpd901_all_incr.msp
[Windows XP]
PlatformID=2
MajorVersion=5
MinorVersion=1
ServicePackMajor=2
[MSI Updater]
Path=WindowsInstaller-KB893803-v2-x86.exe
Hot on the heals of the 9.1 release, we have the security updates for earlier versions of Adobe Reader and Adobe Acrobat.
See the new Security Bulletin at http://www.adobe.com/go/apsb09-04 for details and downloads.
Hot on the heals of the 9.1 release, we have the security updates for earlier versions of Adobe Reader and Adobe Acrobat.
See the new Security Bulletin at http://www.adobe.com/go/apsb09-04 for details and downloads.
If you've been keeping up with the latest Acrobat and Reader security alerts, you'll be glad to know that we have release the 9.1 updates for Adobe Acrobat and Adobe Reader. You can read the details of this update and download the installers here.
The update has been released as a patch for Adobe Acrobat 9.0 Standard, Pro, and Pro Extended and as a full installer for Adobe Reader 9.0.
In addition to the security update, there are bug fixes you should be aware of and a few other details about the 9.1 update that I'll be posting about over the next few days. Until then, don't leave yourself vulnerable, go get the update.
In one of my earlier videos, I talked about how to deploy Acrobat and Reader with all of your settings predefined using the Adobe Customization Wizard. In this video, I talk about how you can adjust the security settings enterprise wide after Acrobat and Reader have already been deployed.
I've also created a PDF Portfolio of all of the security documentation. You can download it by selecting the link at the bottom of the video window.
Just because you can't see something anymore doesn't mean it's no longer there - infants figure that out before they're even a year old. If you want to read about how much NOT using Acrobat can cost you, take a look at the following set of articles. The titles kind of tell the story on their own.
The AP Reveals Details of Facebook/ConnectU Settlement
Properly removing sensitive information
25 Things Facebook Couldn't Keep Secret In Court
I recently updated my video that discusses Acrobat and Reader 9 deployment techniques and it's now posted to Adobe TV. As a part of that I thought, hey, why not create a PDF Portfolio of all of the documentation an IT Manager might need to deploy Acrobat in any number of scenarios.
The link to the ZIP file below contains the Customization Wizard 9 installer and a PDF Portfolio of all of the Acrobat 9 deployment documentation. Inside the portfolio is my video. So now, rather than downloading all of the separate items and trying to keep track of everything, you can just open the PDF Portfolio.
90% of organizations using PDF file format for long-term storage of scanned documents, and 89% are converting Office files to PDF for distribution and archive.
01/14/2009
— AIIM
I couldn't have said it better myself. The best part is it’s not even Adobe research. You can read AIIM’s press release about the research at:
http://www.aiim.org/Research/PDF-Format-of-Choice-for-Document-Archiving.aspx
I've responded to questions about language packs for Reader several times recently so I thought I'd post an entry about it. These files have beep posted since July 2008 but if you're not monitoring the Downloads pages for Reader, you may not have noticed. For future reference, you might want to bookmark...
Downloads for Adobe Reader
Windows | Macintosh
There are two separate functions that the language packs offer:
You can download the dictionary and font packs at the links below.
Adobe Reader 9 Spelling Dictionary Pack
Windows | Macintosh
Adobe Reader 9 Font Packs - Japanese
Windows | Macintosh
Adobe Reader 9 Font Packs - Korean
Windows | Macintosh
Adobe Reader 9 Font Packs - Chinese Traditional
Windows | Macintosh
Adobe Reader 9 Font Packs - Chinese Simplified
Windows | Macintosh
Adobe Reader 9 Extended Language Font Packs (including Chinese Simplified, Chinese Traditional, Korean and Japanese)
Windows | Macintosh
The PDFMakers were introduced with Acrobat 3.0 to make creating PDFs from Office documents easier and faster. In fact, I created one of the earliest prototypes for the Microsoft Word 6.0 PDFMaker way back in the Acrobat 1.0 days just so that I wouldn't have to manually add my links and bookmarks every time I had to re-create a PDF from Word. Now, there are PDFMakers for a long list of applications and they do a lot more than just create bookmarks and links.
A PDFMaker is an Acrobat feature that operates within many business applications, such as Microsoft Office applications, AutoCAD, and Lotus Notes. When you install Acrobat, PDFMaker buttons appear in the authoring application. Using PDFMaker within an authoring application is a simple, one-click procedure. It involves clicking an Acrobat PDFMaker toolbar button or choosing a command on the Adobe PDF menu.
Because PDFMakers run in 3rd party applications and we rely on their APIs to help us add navigational controls to the resulting PDF, we've been able to add new capabilities to the PDFMakers over time as the APIs in the native applications become more robust. Unfortunately, the 3rd party APIs are not consistent across versions and we need to drop support for a particular PDFMaker feature on a particular version of the 3rd party software. To help better understand which version of Acrobat works best with which version of your other desktop applications, the table below lists the supported and unsupported version information about 3rd party applications supported for PDFMakers across the last 4 Acrobat versions.
Few Points to be noted while observing the table below :
Note: This article is also available as a PDF document.
Third party software/versions |
Acrobat 6 |
Acrobat 7 | Acrobat 8 | Acrobat 9 |
| MS Office (Word/Excel/PPT) | ||||
Office 97 |
||||
| Office 2000 (Office 9) | ||||
| Office XP(Office 2002/Office 10) | ||||
| Office 2003(Office 11)(11/17/03) | ||||
| Office 2007 (Office 12)(11/30/06) | N/A | N/A | ||
| Word_Import Comments | ||||
| Office 97 | ||||
| Office 2000 (office 9) | ||||
| Office XP(Office 2002/Office 10) | ||||
| Office 2003(Office 11)(11/17/03) | ||||
| Office 2007 (Office 12)(11/30/06) | N/A | N/A | ||
| MS Outlook | ||||
| Outlook 97(January 16, 1997) | ||||
| Outlook 2000 (office 9)(June 7, 1999) | ||||
| Outlook 2002(May 31, 2001) | ||||
| Outlook(Office 11)(10/21/03) | ||||
| Outlook (Office 12)(11/30/06) | N/A | N/A | ||
| Mail Merge | ||||
| Office 97 | ||||
| Office 2000 (office 9) | ||||
| Office XP(Office 2002/Office 10) | ||||
| Office 2003(Office 11)(11/17/03) | ||||
| Office 2007 (Office 12)(11/30/06) | N/A | N/A | ||
| Attach As PDF | ||||
| Outlook 97(January 16, 1997) | ||||
| Outlook 2000 (office 9)(June 7, 1999) | ||||
| Outlook 2002(May 31, 2001) | ||||
| Outlook(Office 11)(10/21/03) | ||||
| Outlook (Office 12)(11/30/06) | N/A | N/A | ||
| Attach As Secured PDF | ||||
| Outlook 97(January 16, 1997) | ||||
| Outlook 2000 (office 9)(June 7, 1999) | ||||
| Outlook 2002(May 31, 2001) | ||||
| Outlook(Office 11)(10/21/03) | ||||
| Outlook (Office 12)(11/30/06) | N/A | N/A | ||
| MS Visio/Project | ||||
| Office 97 | ||||
| Office 2000 (office 9) | ||||
| Office XP(Office 2002/Office 10) | ||||
| Office 2003(Office 11) | ||||
| Office 2007 (Office 12)(11/30/06) | N/A | N/A | ||
| MS Access | ||||
| Office 97 | ||||
| Office 2000 (office 9) | N/A | |||
| Office XP(Office 2002/Office 10) | N/A | |||
| Office 2003(Office 11) | N/A | |||
| Office 2007 (Office 12)(11/30/06) | N/A | N/A | ||
| MS Publisher | ||||
| Office 97 | ||||
| Office 2000 (office 9) | N/A | |||
| Office XP(Office 2002/Office 10) | N/A | |||
| Office 2003(Office 11) | N/A | |||
| Office 2007 (Office 12)(11/30/06) | N/A | N/A | ||
| Internet explorer | ||||
| 5.01 | ||||
| 5.5 | ||||
| 6 | ||||
| 6.1 | ||||
| 7 | N/A | N/A | ||
| AutoCAD | ||||
| 2000(1999, March) | ||||
| 2000i(2000,July) | ||||
| 2002(2001,June) | ||||
| 2004(2003,march) | ||||
| 2005(2004,march) | N/A | |||
| 2006(2005,march) | N/A | |||
| 2007(2006,march) | N/A | N/A | ||
| 2008(2007,march) | N/A | N/A | N/A | |
| AutoCAD_Import Comments | ||||
| 2000(1999, March) | ||||
| 2000i(2000,July) | ||||
| 2002(2001,June) | ||||
| 2004(2003,march) | ||||
| 2005(2004,march) | N/A | |||
| 2006(2005,march) | N/A | |||
| 2007(2006,march) | N/A | N/A | ||
| 2008(2007,march) | N/A | N/A | N/A | |
| Lotus Notes | ||||
| 6.0.x | ||||
| 6.5.x | ||||
| 7.0.x | ||||
| 8.0.1 | N/A | N/A | N/A | |
| Mac office | ||||
| Office X | ||||
| Office 2004 | N/A |
Adobe has released its latest version of the PDF iFilter, version 9, that will work on 64 Bit Platforms. It is a free update that will give end users and administrators the ability to search and index PDF documents using Microsoft Indexing clients on 64-bit platforms.
PDF iFilter is a plug-in for Microsoft Indexing-compatible software that allows PDF documents to be searched on the desktop and on the server. The 32-bit version of PDF iFilter 9 is already installed automatically with Acrobat 9 and Reader 9.
Read the full article on the "Shredding The Document" blog
If you are concerned about recent online discussions of Acrobat 9 and password encryption, read this excellent post on the Security Matters blog.
New Supported CAD format versions with this update:
CAD Format |
Supported Versions |
Dassault Catia V5 |
Up to R19 |
Autodesk Inventor |
Up to 12.x and 2009 |
CoCreate OneSpace Designer |
V3 to V2008 |
Siemens NX |
Up to NX 6 |
Siemens Parasolid |
Up to 19 |
In order for PDF files to be indexed and searchable by the SharePoint search engine, the SharePoint administrator needs to install an "iFilter" which helps SharePoint search within PDF files. This is similar to how SharePoint searches within Office files, Autodesk files, etc.
Adobe bundles a 32-bit PDF iFilter with Reader and Acrobat. That means that if you install Reader or Acrobat on a SharePoint server running 32-bit Windows, iFilter will be installed automatically. You may then need to do an additional step of registering that iFilter with SharePoint, but it's easy to do that.
More and more users are installing SharePoint on a server running 64-bit Windows. For those users, we currently have a Labs project of a 64-bit iFilter which supports SharePoint.
The Adobe Acrobat and Reader 8.1.3 update addresses a number of customer workflow issues and security vulnerabilities while providing more stability.
Both products should update via the automatic product update system but you can update via manual download from Adobe support or get full installers for Adobe Reader via Reader Download Center
Attention LiveCycle users! Read the list of "Resolved Issues" carefully. Several of the fixes have a "LiveCycle Compatibility Warning:" next to them.
![]()
Confused by all those little icons?. The Digital Signature Validation Cheat Sheet is a handy single page document will help you understand what those icons mean and how you can use them to determine the signer's identity and the document's integrity; both are important.
Get the Digital signature validation cheat sheet
Read the TechNote and installation instructions at the link below.
I recorded a brief presentation covering the enterprise deployment options for Acrobat and Reader along with a shord demo of the new Customization Wizard 9. In the presentation I discuss the various ways to deploy Acrobat and Reader 9 and show how to use the Customization Wizard to supress all of those annoying dialog boxes that pop up when you first install a new piece of software. After watching this you'll know how to deploy Acrobat or Reader so that it is immediately usable by your users withexactly the default settings you need.
Watch: Adobe Acrobat and Reader 9 Deployment Techniques
The Acrobat Customization Wizard 9 and related deployment documents are publicly available on the Developer Connection Enterprise Deployment page.
New documentation includes:
We've also updated a couple of deployment documents specific to Acrobat 8 for all of the luddites out there who don't plan to upgrade any time soon.
Adobe Customization Wizard 9 is a free downloadable utility designed to help IT professionals take greater control of enterprise-wide deployments of Adobe® Acrobat® 9 and Adobe Reader® 9. With it you can customize the Acrobat installer and application features prior to deployment. Providing a graphical interface to the Windows Installer for Acrobat, the Customization Wizard enables IT administrators to modify the installer via a transform file (MST file) without altering the original package (MSI file) to customize the look and feel of Acrobat or Reader before deployment to meet the unique needs of your user base.
You can read more about the Customization Wizard and download it here http://www.adobe.com/support/downloads/detail.jsp?ftpID=3993
We're still working on the Enterprise Deployment web pages so you won't see it available there as of this writing.
Security for Flash Player compatible content in Acrobat 9
The latest releases of Adobe® Acrobat® and Adobe Reader® 9
introduce new native support for the playback of Flash® Player
compatible content. This new feature uses an embedded Flash Player
runtime and hence is independent of other instances of Adobe Flash
Player installed on the system. This white paper provides an overview
of the security model for Flash Player compatible content playing
inside Acrobat and Adobe Reader® software.
Get the complete white paper
Acrobat and Reader 9 Security Administration Guide
This document contains information for advanced users (such as system administrators) who are responsible for deploying and supporting the Adobe Acrobat family of products (including Adobe Reader) where these applications are used for digital signatures and document security. This document pertains only to these application’s security features. It is not an administration guide for other features.
Get the complete guide
There's a new set of documents available for Acrobat and Reader 9. While the page title refers to Reader, the documents themselves apply to both Acrobat 9 and Reader 9. The documents provide guidance and important information regarding changes in Acrobat and Reader 9 that may affect enterprise workflows.
If you are a Reader user or administrator, I recommend you start with the Adobe Reader 9.0 Compatibility Overview document, and then review any of the other documents that are likely to affect your specific organizational workflows.
If you are an Acrobat user or administrator, skip the overview document but review the rest.
Acrobat and Reader9 compatibility documentation
It's finally here. Acrobat 9 is a fantastic release with tons of new features and improvements to existing ones. If you want to buy it now, and you really should, feel free to stop by the Adobe Online Store,or call your reseller. If you're more cautious than that, you can download a fully functional 30 day trial at http://www.adobe.com/tryacrobat.
Once you've got the product or if you're still on the fence about upgrading, watch a recorded presentation by Lori DeFurio covering 6 Cool Things you can do with Acrobat 9.
I'll start posting cool example files once we have the new Reader posted as well.
Security is often at odds with usability. Adobe Flash began addressing this problem several releases ago by implementing and standardizing on a cross-domain security model that has evolved over the years into a robust, secure solution. By providing controls for who may receive data from whom, Adobe Flash can power rich Internet applications that are safe and extremely flexible.
An excellent explanation of the cross-domain security model can be found here
Enhanced Security and the Desktop
As Adobe Acrobat and Reader became more powerful over the years (i.e. support for JavaScript and Web Service interaction), the line between document and application gradually became more blurred, and Adobe began to leverage the Flash security model where appropriate. One such area is in Acrobat and Reader 9, with cross-domain security functionality. Since many users save PDFs to their desktop or open PDFs that are email attachments we needed to add desktop domains to Acrobat and Reader.
Acrobat and Reader 9 provide a method for a user or a system administrator to increase the privileges of chosen files, folders, and hosts by specifying them as privileged locations. Files in these privileged locations are exempted from certain security policies and therefore, for example, can be exempt from cross-domain security. The locations can be set by the user through the UI (Preferences dialog), or by a system administrator using Adobe Customization Wizard to specify installer settings prior to enterprise-wide deployment.
The three choices for privileged locations are:
Files — A file is defined by a path, so its security settings will be invalid if that file is moved. The difference between privileged PDF files and folders is the number of files. If a user has a large number of files they know they can trust, it may be more practical to put them all in one privileged PDF folder. Conversely, a user may use privileged PDF files if they have many PDFs in a single folder but only want to trust two of them.
Folders — Privileged PDF folders are similar to privileged PDF files except that all files in a specified folder (but not in sub-folders) have the same privileges.
Host — A privileged PDF site is appropriate for PDFs that can be opened in a browser from a Web server. A privileged PDF host can only be specified at the host name level; for example, www.adobe.com can be specified, but not www.adobe.com/products/. The specified host must be complete with no wild cards (unlike for crossdomain.xml files). The user will have the option to only specify that the host connection must be secure, for example, that it must be an https: connection. All
PDFs on the specified host will all have the same privileged PDF settings.
Using privileged locations, the user can bypass the security restrictions on the following, which would otherwise be in effect:
•Cross-domain data access
•Silent printing
•External streams access
•Document JavaScript sending data to a remote server
•FDF data injection
•FDF script injection
•Data taint: when data is downloaded from multiple hosts and then sent to another host
Note: This information was extracted from a draft version of the “Enhanced Security in Adobe Acrobat 9 and Adobe Reader 9” White Paper which will be published shortly and includes many more important details than this posting. I’ll supply a link to it when that document becomes final.
With the addition of interactive form features, multimedia, and scripting, PDFs can now download and send data over the Internet, which can create a potential security risk for both user privacy and document integrity. To address those security issues, Adobe® Acrobat® 9 and Adobe Reader® 9 feature an Enhanced Security mode designed to minimize those risks by providing control over cross-domain data access and how FDF files are handled. Because the Enhanced Security restrictions may affect some legacy PDF workflows, Acrobat 9 also provides ways to increase privileges for documents and servers that can be fully trusted.
The enhanced security in Acrobat 9 leverages an existing model already in use by Adobe Flash. By providing controls for who may receive data from whom, Adobe Flash can power rich Internet applications that are safe and extremely flexible. Many Flash developers, such as YouTube, use this model. If your company uses Flash for web applications, there are probably people in your organization who understand how this security model works and it should require only incremental effort to migrate your PDF-based applications to this method.
Sanjoy Ghosh
The Enhanced Security features are turned off by default in Acrobat 9 and Reader 9. The new Customization Wizard 9 will allow you to deploy Acrobat or Reader with Enhanced Security turned on. To find out how, click on the "Deploying Acrobat and Reader" link in the "Online Events" column to the left. Over the next few weeks we'll be finalizing the white papers for Acrobat 9 and I'll be able to share more details on exactly what the Enhanced Security can do for you.
New Support for Adobe Flash Technology, Rich PDF Portfolios and Real-time Capabilities Redefine PDF Communications. Read the full release here.
A trial version will be available for download. Click here to be notified of availability.
With a new version of Acrobat comes a new version of the Customization Wizard.
A free downloadable utility is available to help IT professionals take greater control of enterprise-wide deployments of Adobe Acrobat and Reader® software. By using the Adobe Customization Wizard, you can:
If you are already in the Acrobat 9 prerelease program, you can access a beta version the Customization Wizard 9 from the "Download Software" area. If you are not in the prerelease program, but want to test the Customization Wizard 9 please contact me at AcrobatTechnicalEvangelist@adobe.com
UPDATE: It's available now. Download it here http://www.adobe.com/support/downloads/detail.jsp?ftpID=3993
You can still download the Customization Wizard 8 and get other information about deploying Acrobat and Reader at the IT Solutions web page