Story image

Foxit acknowledges zero-days in its PDF software, but no patches yet

21 Aug 17

Popular PDF tool Foxit Reader has two zero-day vulnerabilities that, if exploited, could give attackers the ability to execute malicious vbscript code on startup.

The vulnerabilities, publicly exposed by the Zero Day Initiatives and AusCERT, affect all versions of Foxit Reader and Foxit PhantomPDF.

The first vulnerability, CVE-2017-10951, is a zero-day involving Foxit Reader’s launchURL Command Injection Remote Code Vulnerability.

According to AusCERT, user interaction such as going to a malicious page or opening a malicious file is required to exploit the vulnerability, which was flagged by security researchers.

“The specific flaw exists within app.launchURL method. The issue result from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process,” a statement from AusCERT says.

Foxit will not be issuing a patch for the vulnerability. It instead released a statement that encourages users to use “Safe Reading Mode”.

"Foxit Reader & PhantomPDF has a Safe Reading Mode which is enabled by default to control the running of JavaScript, which can effectively guard against potential vulnerabilities from unauthorized JavaScript actions,” the company states.

AusCERT says that the only useful mitigation strategy is to only use Foxit with trusted files.

The second vulnerability, CVE-2017-10952, is a zero-day involving Foxit’s Arbitrary File Write Remote Code Execution Vulnerability.

Attackers can launch an attack that also must involve user interaction through a malicious page or file, however this time the issue is with the saveAs Javascript function.

“The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerability to execute code under the context of the current process,” AusCERT states.

Foxit Reader is not patching this vulnerability either, and once again suggests that Safe Reading is the answer.

"Foxit Reader & PhantomPDF has a Safe Reading Mode which is enabled by default to control the running of JavaScript, which can effectively guard against potential vulnerabilities from unauthorized JavaScript actions,” the company says in a statement.

AusCERT also says that for this vulnerability, people should only use Foxit Reader for trusted files.

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Verifi takes spot in Deloitte Asia Pacific Fast 500
"An increasing amount of companies captured by New Zealand’s Anti-Money laundering legislation are realising that an electronic identity verification solution can streamline their customer onboarding."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
What disaster recovery will look like in 2019
“With nearly half of all businesses experiencing an unrecoverable data event in the last three years, current backup solutions are no longer fit for purpose."
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.