QID 375911

QID 375911: Foxit Reader and Foxit PhantomPDF Spoofing Vulnerability

Foxit Reader is a multilingual freemium PDF tool that can create, view, edit, digitally sign, and print PDF files.
Foxit PhantomPDF Suite is a business ready PDF toolkit, used to create professional PDF documents.

Affected versions:
Windows
Foxit PDF Reader 10.0.1.35811 and earlier
Foxit PhantomPDF 10.0.1.35811, 10.0.0.35798, 9.7.3.29555 and earlier

MAC OS
Foxit Reader Mac 4.0.0.0430 and earlier Foxit PhantomPDF Mac 4.0.0.0430 and earlier
QID detection logic:(Authenticated)
This QID checks Windows Registry to get Foxit Reader and Foxit PhantomPDF installation path and then reads corresponding executable((FoxitReader.exe/FoxitPhantomPDF.exe)) to see if it's running a vulnerable version.
We check the version of the Foxit Reader application on MAC to check if it is vulnerable or not.

Successful exploitation could expose the application to An attacker can spoof a certified PDF document via an Evil Annotation Attack because the products fail to consider a null value for a Subtype entry of the Annotation dictionary

CVSS V3 rated as High - 7.8 severity.

CVSS V2 rated as High - 6.8 severity.

Solution

The vendor has issued a fix. For more information please visit advisory

Vendor References

Foxit - www.foxit.com/support/security-bulletins.html

CVEs related to QID 375911

CVE-2020-35931 |

Software Advisories

Advisory ID	Software	Component	Link
Foxit			www.foxit.com/support/security-bulletins.html

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].