Foxit Reader PDF Handling Multiple Remote Vulnerabilities
BID:34035
Info
Foxit Reader PDF Handling Multiple Remote Vulnerabilities
| Bugtraq ID: | 34035 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2009-0191 CVE-2009-0836 CVE-2009-0837 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 09 2009 12:00AM |
| Updated: | May 21 2012 09:30PM |
| Credit: | Alin Rad Pop and Core Security Technologies |
| Vulnerable: |
Foxit Foxit Reader 3.0.2009 .1301 Foxit Foxit Reader 3.0 Foxit Foxit Reader 2.3 |
| Not Vulnerable: |
Foxit Foxit Reader 3.0 Build 1506 Foxit Foxit Reader 2.3 Build 3902 |
Discussion
Foxit Reader PDF Handling Multiple Remote Vulnerabilities
Foxit Reader is prone to multiple remote vulnerabilities,
Attackers may leverage these issues to execute arbitrary code in the context of the application. Successful exploits may compromise the application and the underlying computer. Failed attacks will cause denial-of-service conditions.
The issues affect Foxit Reader 3.0.2009.1301, 3.0, and 2.3. Other versions may also be affected.
Foxit Reader is prone to multiple remote vulnerabilities,
Attackers may leverage these issues to execute arbitrary code in the context of the application. Successful exploits may compromise the application and the underlying computer. Failed attacks will cause denial-of-service conditions.
The issues affect Foxit Reader 3.0.2009.1301, 3.0, and 2.3. Other versions may also be affected.
Exploit / POC
Foxit Reader PDF Handling Multiple Remote Vulnerabilities
The following exploits are available to members of the Immunity Partners program:
https://www.immunityinc.com/downloads/immpartners/FoxitLaunchit.tar.gz
https://www.immunityinc.com/downloads/immpartners/foxit_Action.tar
Multiple exploit examples are available.
UPDATE (March 26, 2009): The buffer-overflow issue is being exploited in the wild. Please see the references for more information.
UPDATE (May 21, 2012): A Metasploit exploit module is available for the buffer-overflow issue.
The following exploits are available to members of the Immunity Partners program:
https://www.immunityinc.com/downloads/immpartners/FoxitLaunchit.tar.gz
https://www.immunityinc.com/downloads/immpartners/foxit_Action.tar
Multiple exploit examples are available.
UPDATE (March 26, 2009): The buffer-overflow issue is being exploited in the wild. Please see the references for more information.
UPDATE (May 21, 2012): A Metasploit exploit module is available for the buffer-overflow issue.
Solution / Fix
Foxit Reader PDF Handling Multiple Remote Vulnerabilities
Solution:
The vendor has released updates. Please see the references for more information.
Solution:
The vendor has released updates. Please see the references for more information.
References
Foxit Reader PDF Handling Multiple Remote Vulnerabilities
References:
References:
- Foxit Reader Homepage (Foxit )
- Foxit Reader JBIG2 Symbol Dictionary Processing Vulnerability (Secunia)
- Foxit Reader Multiple Vulnerabilities (CORE-2009-0218) (Core Security Technologies Advisories
- Secunia Research: Foxit Reader JBIG2 Symbol Dictionary Processing Vulnerability (Secunia Research
- Bloodhound.PDF.9 (Symantec)
- Building the Most Secure PDF Reader (Foxit)
- CORE-2009-0218 Foxit Reader Multiple Vulnerabilities (Core Security)