unescape.jpgNot every vulnerability in Adobe Acrobat or Flash involves JavaScript (or ActionScript, a derivative language in Flash), but almost all real-world exploits of them involve it. Thus the ability to block individual scripting functions and features is a useful, flexible mitigation tool.

The JavaScript Blacklist Framework first came to light in an Adobe Technote in December describing how to use it to block a JavaScript object, DocMedia, which had a vulnerability. Researcher Didier Stevens created a video showing how the Framework works and security vendor Sourcefire did some testing and wrote an analysis along with some test files you can use yourself to explore it.

One of the things that was noticed quickly, at least by Stevens, was that you couldn't use the Framework to block access to the JavaScript unescape() function. This is particularly inconvenient because unescape is a staple of JavaScript-based exploit code, as it is used to create an instance of the executable shell code which will be triggered by the vulnerability. See this Websense analysis for a typical example. unescape() doesn't have a lot of real-world application outside of this, so if users could block it in Acrobat, especially through network group policy (which the JavaScript Blacklist Framework lets you do), it would be an easy and cheap way to make vulnerability exploits much harder to pull off.

Shortly after word got out about this problem, Adobe's Director for Product Security & Privacy Brad Arkin tweeted that they were working on the problem and would report soon on it.

Nothing happened. Then the Aurora attacks happened and people began to think of other things when they thought of Adobe, But Adobe was working on the problem.

Unfortunately, now it appears that Adobe has struck out on their efforts to implement an unescape() block in current products. The official word is that they're still looking into it, but their efforts so far have not succeeded. It's their program of course, and their source code, so they can build it in to a future version if they wish, but it's still disappointing because users move slowly from generation to generation of a major program like Acrobat.

I honestly think that things are trending better for Adobe and their products if only because it's clear they care now and have put some good people on the problems, but they've got a lot of work ahead of them. Their products have a huge attack surface that was built in an era before security was fully appreciated, and it will take some time before the right values are instilled into their software. It's sort of like where Microsoft was 7 or 8 years ago. If Microsoft can turn it around, so can Adobe.