A Survey: Vulnerabilities Present in PDF Files

Introduction

Portable Document Format can be abbreviated as PDF and have about two decades of existence, each version of which offers extra features, extensions that may support JavaScript, embedded files and offering huge amount of advantages. In 2008, PDF documents have become a standard in providing the platform independency, security and portability over the other documents formats like wordpad etc. There exist many applications who can not view these files. With these kind of features were consider PDF files as most safe, as they are not executed. In the previous decade too PDF succeeded to maintain a privileged position over the document formats. Until joined the list of non - executable files that they have served as a vehicle for new attacks, such as files text documents, spreadsheets, presentations, video or audio files, allowing Attackers seize computers with the simple fact that a user open a PDF document in your computer.

Recently many news have been aired related to new types of exploitation and abuses that can be done using the PDF files, and certain measures to eliminate these using various types of anti-virus and anti-malware software. These files have also become a complex task in analyzing the signature used on regular basis. For example in is demonstrated as using an encoder little used to use a known vulnerability in the handling of TIFF files (CVE-2010-0188). In described another attack where exploits an old vulnerability (CVE-2010-0188) where XML is hidden in a TIFF, but this time using a bit encoding used to generate the XML, so They are avoiding detection by antivirus.

Figure 1.

PDF file format