Story image

Foxit acknowledges zero-days in its PDF software, but no patches yet

21 Aug 2017

Popular PDF tool Foxit Reader has two zero-day vulnerabilities that, if exploited, could give attackers the ability to execute malicious vbscript code on startup.

The vulnerabilities, publicly exposed by the Zero Day Initiatives and AusCERT, affect all versions of Foxit Reader and Foxit PhantomPDF.

The first vulnerability, CVE-2017-10951, is a zero-day involving Foxit Reader’s launchURL Command Injection Remote Code Vulnerability.

According to AusCERT, user interaction such as going to a malicious page or opening a malicious file is required to exploit the vulnerability, which was flagged by security researchers.

“The specific flaw exists within app.launchURL method. The issue result from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process,” a statement from AusCERT says.

Foxit will not be issuing a patch for the vulnerability. It instead released a statement that encourages users to use “Safe Reading Mode”.

"Foxit Reader & PhantomPDF has a Safe Reading Mode which is enabled by default to control the running of JavaScript, which can effectively guard against potential vulnerabilities from unauthorized JavaScript actions,” the company states.

AusCERT says that the only useful mitigation strategy is to only use Foxit with trusted files.

The second vulnerability, CVE-2017-10952, is a zero-day involving Foxit’s Arbitrary File Write Remote Code Execution Vulnerability.

Attackers can launch an attack that also must involve user interaction through a malicious page or file, however this time the issue is with the saveAs Javascript function.

“The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerability to execute code under the context of the current process,” AusCERT states.

Foxit Reader is not patching this vulnerability either, and once again suggests that Safe Reading is the answer.

"Foxit Reader & PhantomPDF has a Safe Reading Mode which is enabled by default to control the running of JavaScript, which can effectively guard against potential vulnerabilities from unauthorized JavaScript actions,” the company says in a statement.

AusCERT also says that for this vulnerability, people should only use Foxit Reader for trusted files.

Cloud application attacks in Q1 up by 65% - Proofpoint
Proofpoint found that the education sector was the most targeted of both brute-force and sophisticated phishing attempts.
Singapore firm to launch borderless open data sharing platform
Singapore-based Ocean Protocol, a decentralised data exchange that promotes data sharing, has revealed details of what could be the kickstart to a global and borderless data economy.
Huawei picks up accolades for software-defined camera ecosystem
"The company's software defined capabilities enable it to future-proof its camera ecosystem and greatly lower the total cost of ownership (TCO), as its single camera system is applicable to a variety of application use cases."
Tech community rocked by deaths of Atta Elayyan and Syed Jahandad Ali
Both men were among the 50 killed in the shooting in Christchurch last Friday when a gunman opened fire at two mosques.
NZ ISPs block internet footage of Christchurch shootings
2degrees, Spark, Vodafone and Vocus are now blocking any website that shows footage of the mosque shootings.
Barracuda expands MSP security offerings with RMM acquisition
Managed Workplace delivers an RMM platform with security tools and services, such as site security assessments, Office 365 account management, and integrated third-party antivirus.
Flashpoint: APAC companies must factor geopolitics in cyber strategies
The diverse geopolitical and economic interests of the states in the region play a significant role in driving and shaping cyber threat activity against entities operating in APAC.
Expert offers password tips to aid a stress-free sleep
For many cybersecurity professionals, the worries of the day often crawl into night-time routines - LogMeIn says better password practices can help.