A group of researchers developed a tool capable of detecting errors in the way applications such as Adobe Acrobat or Microsoft Word process JavaScript code, which has allowed finding a total of 134 security flaws, of which 33 have already received a CVE tracking key.
The tool is called “Cooper”, in reference to the technique known as “Cooperative Mutation” it employees. Xu Peng, a software development specialist and co-author of the tool, explains that tools like the ones mentioned accept information from scripting languages; for example, Acrobat allows JavaScript to manipulate PDF files.
This requires the PDF to define native PDF objects and parse the JavaScript code. Native objects are processed by Acrobat modules and a built-in JavaScript engine handles the scripts, while a “binding layer” does the translation.
Comments are closed.