1

If you analyze or disarm a potential unsafe pdf file using pdfid , will it infect the machine while doing it? Is it the same with peepdf?

1 Answer 1

2

It generally depends on how it is unsafe. If it is unsafe because of a vulnerability in a pdf handling library used by pdfid then it may compromise that machine.

If it's unsafe because of a vulnerability in random reader, that does not affect pdfid or any of it's libraries, then no, it will not affect that machine.

As always the first step is to analyze the threat. What is the threat? What is the target of the threat? What mechanisms does the threat use to achieve this target?

If you identify that JavaScript embedded in the PDF is the mechanism, any tool that is able to strip the script, without executing it, will be perfectly safe. So will any viewer not executing it.

If the mechanism is a buffer overflow in Acrobat Reader, any reader and tool not based on Adobe code is likely to be unaffected.

Once you understand a threat, you can protect against it. This may be stripping JavaScript from PDFs, or blocking them outright if you find no effective way to protect, and the risk outweighs the benefits of allowing PDFs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .