New issue
Advanced search Search tips

Issue 691948 link

Starred by 7 users

Issue metadata

Status: WontFix
Owner: ----
Closed: Feb 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security: "Protected" PDFs generated by Acrobat can be printed to "Unprotected" PDFs

Reported by am7p...@gmail.com, Feb 14 2017

Issue description

VERSION
Chrome Version: 56.0.2924.87 + stable
Operating System: MS Windows 10

REPRODUCTION CASE
Dear Support,
I was able to break the security of a pdf file easily (without buying any additional software and without using any cracking tool).

as you can see in the attachments, the security properties was changed from:
Acrobat Security Before.png
to:
Acrobat Security After.png

How?
I opened Google Chrome and dragged the pdf file into it and the file was opened in chrome.
 
Then I went to the menu of Chrome and clicked on Print and selected Save As PDF, and I got the non-secured version.

I contacted Adobe about it and they recommended to contact you.


Best Regards,
Mohammed Al-Shehri

 
Acrobat Security Before.png
32.8 KB View Download
Acrobat Security After.png
28.6 KB View Download
Components: Internals>Plugins>PDF
Summary: Security: "Protected" PDFs generated by Acrobat can be printed to "Unprotected" PDFs (was: Security: Was able to Break Adobe Acrobat Security Easily)
This is probably "by-design" insofar as it's likely outside of Adobe's threat model, and it's not reasonable for Adobe to expect third-party PDF implementations to try to prevent this bypass.
Labels: -Restrict-View-SecurityTeam allpublic
Status: WontFix (was: Unconfirmed)
Mechanisms to bypass the "Document Restrictions" feature of Adobe Acrobat are numerous; printing to Chrome's "Save as PDF" feature is only one of many. This does not represent a security vulnerability in Chrome.

Comment 3 by am7p...@gmail.com, Feb 15 2017

Dear Support,

Thank you very much for your reply.

Please note that I am not getting this issue in other browsers (like IE or Firefox), but I am facing it in Chrome!

I conferred with Adobe on this issue, and you may reach out to psirt@adobe.com to discuss that issue further (if needed).


Best Regards,
Mohammed Al-Shehri

Neither Internet Explorer nor Firefox includes a PDF generation engine. 

Windows 10 does include one ("Microsoft Print to PDF") and it too allows users to print a restricted PDF to a new PDF without the restrictions.

Comment 5 by am7p...@gmail.com, Feb 16 2017

Thank you very much.
 Issue 701576  has been merged into this issue.
 Issue 724465  has been merged into this issue.
 Issue 758499  has been merged into this issue.

Comment 9 by mea...@chromium.org, Sep 15 2017

 Issue 765508  has been merged into this issue.
 Issue 765536  has been merged into this issue.

Sign in to add a comment