SB2017091104 - Multiple vulnerabilities in Foxit PhantomPDF
Published: September 11, 2017
Security Bulletin ID
SB2017091104
Severity
Low
Patch available
YES
Number of vulnerabilities
4
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Command injection (CVE-ID: N/A)
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.The weakness exists due to command injection flaw when application is not running in Safe-Reading-mode. A remote attacker can trick the victim into opening a specially crafted .pdf file, abuse the app.launchURL JavaScript call, inject arbitrary commands and execute arbitrary code.
2) Improper input validation (CVE-ID: N/A)
The vulnerability allows a remote attacker to write arbitrary files on the target system.The weakness exists due to input validation flaw when application is not running in Safe-Reading-mode. A remote attacker can trick the victim into opening a specially crafted .pdf file, abuse the this.saveAs function call, drop a file to the local file system and execute arbitrary code.
3) Improper input validation (CVE-ID: N/A)
The vulnerability allows a remote attacker to write arbitrary files on the target system.The weakness exists due to input validation flaw when application is not running in Safe-Reading-mode. A remote attacker can trick the victim into opening a specially crafted .pdf file, abuse the createDataObject function call, create arbitrary executable file in the local file system and execute arbitrary code.
4) Command injection (CVE-ID: N/A)
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.The weakness exists due to command injection flaw when application is not running in Safe-Reading-mode. A remote attacker can trick the victim into opening a specially crafted .pdf file, abuse the xfa.host.gotoURL function call, inject arbitrary commands and execute arbitrary code.
Remediation
Install update from vendor's website.