Story image

Foxit acknowledges zero-days in its PDF software, but no patches yet

21 Aug 17

Popular PDF tool Foxit Reader has two zero-day vulnerabilities that, if exploited, could give attackers the ability to execute malicious vbscript code on startup.

The vulnerabilities, publicly exposed by the Zero Day Initiatives and AusCERT, affect all versions of Foxit Reader and Foxit PhantomPDF.

The first vulnerability, CVE-2017-10951, is a zero-day involving Foxit Reader’s launchURL Command Injection Remote Code Vulnerability.

According to AusCERT, user interaction such as going to a malicious page or opening a malicious file is required to exploit the vulnerability, which was flagged by security researchers.

“The specific flaw exists within app.launchURL method. The issue result from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process,” a statement from AusCERT says.

Foxit will not be issuing a patch for the vulnerability. It instead released a statement that encourages users to use “Safe Reading Mode”.

"Foxit Reader & PhantomPDF has a Safe Reading Mode which is enabled by default to control the running of JavaScript, which can effectively guard against potential vulnerabilities from unauthorized JavaScript actions,” the company states.

AusCERT says that the only useful mitigation strategy is to only use Foxit with trusted files.

The second vulnerability, CVE-2017-10952, is a zero-day involving Foxit’s Arbitrary File Write Remote Code Execution Vulnerability.

Attackers can launch an attack that also must involve user interaction through a malicious page or file, however this time the issue is with the saveAs Javascript function.

“The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerability to execute code under the context of the current process,” AusCERT states.

Foxit Reader is not patching this vulnerability either, and once again suggests that Safe Reading is the answer.

"Foxit Reader & PhantomPDF has a Safe Reading Mode which is enabled by default to control the running of JavaScript, which can effectively guard against potential vulnerabilities from unauthorized JavaScript actions,” the company says in a statement.

AusCERT also says that for this vulnerability, people should only use Foxit Reader for trusted files.

Accenture 'largest Oracle Cloud integrator in A/NZ'
Accenture has bought out Oracle Software-as-a-Service provider PrimeQ, which now makes Accenture the largest Oracle Cloud systems integrator in Australia and New Zealand.
Australian businesses get serious about SD-WAN
"SD-WAN is doing to enterprise networks what virtualisation did to enterprise data centres almost a decade ago, but it's happening much faster."
How to keep network infrastructure secure and available
Two OVH executives have weighed in on how network infrastructure and the challenges in that space will be evolving in the coming year.
White box losing out to brands in 100 GE switching market
H3C, Cisco and Huawei have all gained share in the growing competition in the data centre switching market.
Gartner names newcomer Exabeam a leader in SIEM
The vendor landscape for SIEM is evolving, with recent entrants bringing technologies optimised for analytics use cases.
52mil users affected by Google+’s second data breach
Google+ APIs will be shut down within the next 90 days, and the consumer platform will be disabled in April 2019 instead of August 2019 as originally planned.
How Fujitsu aims to tackle digitalisation and the data that comes with it
Fujitsu CELSIUS workstations aim to be the ideal platform for accelerating innovation and data-rich design.
Genesys PureCloud generates triple-digit revenue growth year on year
In Australia and New Zealand, the company boosted PureCloud revenue by nearly 100%.