7

I use Linux on my desktop, but I got suprised after checking random PDF files on my machines with Virustotal. One of them contained a "PDF.Exploit.CVE_2008_2992". So PDF files can have malicious content in them.

Question: How can I "sterilize" a PDF file? I'm thinking of converting a PDF file to a PDF file (maybe remove javascript in them?).

Improve this question
3
  • 2
    Maybe convert to Postscript and back to PDF? But Postscript is a turing-complete language so I'm not even sure that's guaranteed. That's all assuming of course that the PDF viewer doesn't have security bugs.
    – Celada
    Nov 8 '14 at 18:47
  • 3
    Print it, then scan it.
    – tylerl
    Nov 9 '14 at 1:03
  • It is not sure what that Virustotal scans for. If it scans for the use of the util.printf() command, but does not evaluate its arguments, it is with a very high probabilty creating a false positive. And it also depends a lot on where that util.printf() command is invoked.
    – Max Wyss
    Nov 9 '14 at 12:29
3

A quick Google searchs turns up the PDF Javascript Stripper, which appears to do just that.

But bear in mind that PDF is a subset of Postscript, which is a Turing-complete language. So there may be other attack vectors, not just embedded JavaScript (even if that arguably is the biggest one), and it’s thus mathematically impossible to know that your PDF is actually ‘safe’.

If a malicious PDF file targets a vulnerability in a specific PDF reader, or an associated library, then ‘sterilising’ them in a general way either won’t work (and thus give a false sense of security) or would be overzealous and remove too much information. Just imagine stripping all JPEGs from PDF files to avert the Microsoft GDI+ JPEG vulnerability…

Improve this answer
1
  • However, for that particular vulnerabilty, the use of util.printf() is the attack vector, and with that gone, it is no longer possible to use it.
    – Max Wyss
    Nov 9 '14 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.