Timing attack in Foxit PDF Editor (formerly Foxit PhantomPDF) and Foxit PDF Reader for Windows - CVE-2018-5675
Published: May 18, 2018
Vulnerability identifier: #VU12830
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-5675
CWE-ID: CWE-385
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists in the OpenSSL RSA Key generation algorithm due to a cache timing side channel attack. A remote attacker with sufficient access to mount cache timing attacks during the RSA key generation process can recover the private key.
The weakness exists in the OpenSSL RSA Key generation algorithm due to a cache timing side channel attack. A remote attacker with sufficient access to mount cache timing attacks during the RSA key generation process can recover the private key.
Affected software
Foxit PDF Editor (formerly Foxit PhantomPDF)
Foxit PDF Reader for Windows
Foxit PDF Reader for Windows
How to mitigate CVE-2018-5675
Install update from vendor's website.