Vulnerabilities > CVE-2019-6729 - Out-of-bounds Read vulnerability in Foxitsoftware Phantompdf

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
foxitsoftware
CWE-125
nessus
NVD
Published: 2019-03-21
Updated: 2020-10-05

Summary

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7423.

Vulnerable Configurations

Part Description Count
Application
Foxitsoftware
195
OS
Microsoft
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familyWindows
    NASL idFOXIT_PHANTOM_8_3_9.NASL
    descriptionAccording to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 8.3.9. It is, therefore, affected by following vulnerabilities: - An out-of-bounds read/write vulnerability exists when handling certain XFA element attributes. This occurs due to improper calculation of a null-terminated character and may cause an application crash. (CVE-2018-3956) - A signature validation bypass vulnerability exists which provides incorrect results when validating certain PDF documents. (CVE-2018-18688/CVE-2018-18689) - Flaws in how PDF files are processed/handled could lead to arbitrary code execution. An attacker can exploit this by convincing a user to open a specially crafted file in order to cause the execution of arbitrary code. (CVE-2019-6728,CVE-2019-6729) Additionally, the application was affected by multiple potential information disclosure, denial of service, and remote code execution vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id121246
    published2019-01-18
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121246
    titleFoxit PhantomPDF < 8.3.9 Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(121246);
  script_version("1.4");
  script_cvs_date("Date: 2019/10/31 15:18:52");

  script_cve_id(
    "CVE-2018-3956",
    "CVE-2018-18688",
    "CVE-2018-18689",
    "CVE-2019-5005",
    "CVE-2019-5006",
    "CVE-2019-5007",
    "CVE-2019-6727",
    "CVE-2019-6728",
    "CVE-2019-6729",
    "CVE-2019-6730",
    "CVE-2019-6731",
    "CVE-2019-6732",
    "CVE-2019-6733",
    "CVE-2019-6734",
    "CVE-2019-6735"
  );
  script_bugtraq_id(106798, 107496, 107552);
  script_xref(name:"ZDI", value:"ZDI-CAN-7347");
  script_xref(name:"ZDI", value:"ZDI-CAN-7452");
  script_xref(name:"ZDI", value:"ZDI-CAN-7601");
  script_xref(name:"ZDI", value:"ZDI-CAN-7353");
  script_xref(name:"ZDI", value:"ZDI-CAN-7423");
  script_xref(name:"ZDI", value:"ZDI-CAN-7368");
  script_xref(name:"ZDI", value:"ZDI-CAN-7369");
  script_xref(name:"ZDI", value:"ZDI-CAN-7453");
  script_xref(name:"ZDI", value:"ZDI-CAN-7576");
  script_xref(name:"ZDI", value:"ZDI-CAN-7355");

  script_name(english:"Foxit PhantomPDF < 8.3.9 Multiple Vulnerabilities");
  script_summary(english:"Checks the version of Foxit PhantomPDF.");

  script_set_attribute(attribute:"synopsis", value:
"A PDF toolkit installed on the remote Windows host is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its version, the Foxit PhantomPDF application (formally
known as Phantom) installed on the remote Windows host is prior to
8.3.9. It is, therefore, affected by following vulnerabilities:

  - An out-of-bounds read/write vulnerability exists
    when handling certain XFA element attributes.
    This occurs due to improper calculation of a
    null-terminated character and may cause an application crash.
    (CVE-2018-3956)

  - A signature validation bypass vulnerability exists
    which provides incorrect results when validating
    certain PDF documents.
    (CVE-2018-18688/CVE-2018-18689)

  - Flaws in how PDF files are processed/handled could
    lead to arbitrary code execution. An attacker can 
    exploit this by convincing a user to open a specially
    crafted file in order to cause the execution of arbitrary
    code. (CVE-2019-6728,CVE-2019-6729)

Additionally, the application was affected by multiple potential 
information disclosure, denial of service, and remote code execution
vulnerabilities.");
  # https://www.foxitsoftware.com/support/security-bulletins.php
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2f244c3e");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Foxit PhantomPDF version 8.3.9 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6729");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/01/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantom");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantompdf");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("foxit_phantom_installed.nasl");
  script_require_keys("installed_sw/FoxitPhantomPDF");

  exit(0);
}

include('vcf.inc');

app = 'FoxitPhantomPDF';

app_info = vcf::get_app_info(app:app, win_local:TRUE);

constraints = [{
  'min_version' : '8.0',
  'max_version' : '8.3.8.39677',
  'fixed_version' : '8.3.9'
  }];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
  • NASL familyWindows
    NASL idFOXIT_READER_9_4.NASL
    descriptionThe version of Foxit Reader installed on the remote Windows host is prior to 9.4. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds read/write vulnerability and crash when handling XFA element attributes. (CVE-2018-3956) - A signature validation bypass vulnerability which could lead to incorrect validation results. (CVE-2018-18688, CVE-2018-18689) - Flaws in how PDF files are processed/handled could lead to arbitrary code execution. An attacker can exploit this by convincing a user to open a specially crafted file in order to cause the execution of arbitrary code. (CVE-2019-6728,CVE-2019-6729) Additionally, the application was affected by multiple potential information disclosure, denial of service, and remote code execution vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id121046
    published2019-01-09
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121046
    titleFoxit Reader < 9.4 Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(121046);
  script_version("1.6");
  script_cvs_date("Date: 2019/10/31 15:18:52");

  script_cve_id(
    "CVE-2018-3956",
    "CVE-2018-18688",
    "CVE-2018-18689",
    "CVE-2019-5005",
    "CVE-2019-5006",
    "CVE-2019-5007",
    "CVE-2019-6727",
    "CVE-2019-6728",
    "CVE-2019-6729",
    "CVE-2019-6730",
    "CVE-2019-6731",
    "CVE-2019-6732",
    "CVE-2019-6733",
    "CVE-2019-6734",
    "CVE-2019-6735"
  );
  script_bugtraq_id(106798, 107496, 107552);

  script_name(english:"Foxit Reader < 9.4 Multiple Vulnerabilities");
  script_summary(english:"Checks the version of Foxit Reader.");

  script_set_attribute(attribute:"synopsis", value:
"A PDF viewer installed on the remote Windows host is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Foxit Reader installed on the remote Windows host is
prior to 9.4. It is, therefore, affected by multiple vulnerabilities:

  - An out-of-bounds read/write vulnerability and crash
    when handling XFA element attributes. (CVE-2018-3956)

  - A signature validation bypass vulnerability which
    could lead to incorrect validation results.
    (CVE-2018-18688, CVE-2018-18689)

  - Flaws in how PDF files are processed/handled could
    lead to arbitrary code execution. An attacker can 
    exploit this by convincing a user to open a specially
    crafted file in order to cause the execution of arbitrary
    code. (CVE-2019-6728,CVE-2019-6729)

Additionally, the application was affected by multiple potential 
information disclosure, denial of service, and remote code execution
vulnerabilities.");
  script_set_attribute(attribute:"see_also", value:"https://www.foxitsoftware.com/support/security-bulletins.php");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Foxit PhantomPDF version 9.4 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6729");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/01/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:foxit_reader");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("foxit_reader_installed.nasl");
  script_require_keys("installed_sw/Foxit Reader");

  exit(0);
}

include('vcf.inc');

app = 'Foxit Reader';

app_info = vcf::get_app_info(app:app, win_local:TRUE);

constraints = [{
  'min_version' : '9.0',
  'max_version' : '9.3.0.10826',
  'fixed_version' : '9.4'
  }];
  
vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
  • NASL familyWindows
    NASL idFOXIT_PHANTOM_9_4.NASL
    descriptionAccording to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 9.4. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds read/write vulnerability and crash when handling XFA element attributes. (CVE-2018-3956) - A signature validation bypass vulnerability which could lead to incorrect validation results. (CVE-2018-18688, CVE-2018-18689) - Flaws in how PDF files are processed/handled could lead to arbitrary code execution. An attacker can exploit this by convincing a user to open a specially crafted file in order to cause the execution of arbitrary code. (CVE-2019-6728,CVE-2019-6729) Additionally, the application was affected by multiple potential information disclosure, denial of service, and remote code execution vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id121045
    published2019-01-09
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121045
    titleFoxit PhantomPDF < 9.4 Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(121045);
  script_version("1.6");
  script_cvs_date("Date: 2019/10/31 15:18:52");

  script_cve_id(
    "CVE-2018-3956",
    "CVE-2018-18688",
    "CVE-2018-18689",
    "CVE-2019-5005",
    "CVE-2019-5006",
    "CVE-2019-5007",
    "CVE-2019-6727",
    "CVE-2019-6728",
    "CVE-2019-6729",
    "CVE-2019-6730",
    "CVE-2019-6731",
    "CVE-2019-6732",
    "CVE-2019-6733",
    "CVE-2019-6734",
    "CVE-2019-6735"
  );
  script_bugtraq_id(106798, 107496, 107552);

  script_name(english:"Foxit PhantomPDF < 9.4 Multiple Vulnerabilities");
  script_summary(english:"Checks the version of Foxit PhantomPDF.");

  script_set_attribute(attribute:"synopsis", value:
"A PDF toolkit installed on the remote Windows host is affected by
a multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its version, the Foxit PhantomPDF application (formally
known as Phantom) installed on the remote Windows host is prior to
9.4. It is, therefore, affected by multiple vulnerabilities:

  - An out-of-bounds read/write vulnerability and crash
    when handling XFA element attributes. (CVE-2018-3956)

  - A signature validation bypass vulnerability which
    could lead to incorrect validation results.
    (CVE-2018-18688, CVE-2018-18689)

  - Flaws in how PDF files are processed/handled could
    lead to arbitrary code execution. An attacker can 
    exploit this by convincing a user to open a specially
    crafted file in order to cause the execution of arbitrary
    code. (CVE-2019-6728,CVE-2019-6729)

Additionally, the application was affected by multiple potential 
information disclosure, denial of service, and remote code execution
vulnerabilities.");
  script_set_attribute(attribute:"see_also", value:"https://www.foxitsoftware.com/support/security-bulletins.php");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Foxit PhantomPDF version 9.4 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6729");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/01/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantom");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantompdf");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("foxit_phantom_installed.nasl");
  script_require_keys("installed_sw/FoxitPhantomPDF");

  exit(0);
}

include('vcf.inc');

app = 'FoxitPhantomPDF';

app_info = vcf::get_app_info(app:app, win_local:TRUE);

constraints = [{
  'min_version' : '9.0',
  'max_version' : '9.3.0.10826',
  'fixed_version' : '9.4'
  }];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);

References