53 Bugs in 50 Days: Researchers Fuzz Adobe Reader

guest · Dec 17, 2018

53 Bugs in 50 Days: Researchers Fuzz Adobe Reader
December 17, 2018
https://www.darkreading.com/threat-...-researchers-fuzz-adobe-reader/d/d-id/1333507

Professional threat researchers commonly use fuzzing in lab environments to find new vulnerabilities in hardware and software. They inject invalid and sometimes semi-random data into an interface or program and watch for crashes, potential memory leaks, undocumented jumps to debug routines, failing code assertions, and other activity, Manky explains.

For their fuzzer, researchers chose WinAFL, a common Windows fuzzing framework, and targeted Adobe Reader in "the most vanilla experiment we could think of," they explain in a report on the findings.
A 50-day timeframe was chosen for the full project: reverse-engineering code, hunting for potential vulnerable libraries, writing harnesses, and running the fuzzer itself.

Their strategy led to the discovery of 53 critical bugs in Adobe Reader and Adobe Pro, and they repeated the process for different parsers to come up with their final list of CVEs.
Click to expand...

Beyonder · Dec 17, 2018

Which is precisely why I stick to SumatraPDF whenever I possibly can.

Log in or Sign up

53 Bugs in 50 Days: Researchers Fuzz Adobe Reader

guest Guest

Beyonder Registered Member

Log in or Sign up

53 Bugs in 50 Days: Researchers Fuzz Adobe Reader

guest Guest

Beyonder Registered Member

Useful Searches