Vulnerabilities > CVE-2019-6730 - Use After Free vulnerability in Foxitsoftware Reader

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
foxitsoftware
CWE-416
nessus

Summary

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the popUpMenu method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7368.

Vulnerable Configurations

Part Description Count
Application
Foxitsoftware
195
OS
Microsoft
1

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyWindows
    NASL idFOXIT_PHANTOM_8_3_9.NASL
    descriptionAccording to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 8.3.9. It is, therefore, affected by following vulnerabilities: - An out-of-bounds read/write vulnerability exists when handling certain XFA element attributes. This occurs due to improper calculation of a null-terminated character and may cause an application crash. (CVE-2018-3956) - A signature validation bypass vulnerability exists which provides incorrect results when validating certain PDF documents. (CVE-2018-18688/CVE-2018-18689) - Flaws in how PDF files are processed/handled could lead to arbitrary code execution. An attacker can exploit this by convincing a user to open a specially crafted file in order to cause the execution of arbitrary code. (CVE-2019-6728,CVE-2019-6729) Additionally, the application was affected by multiple potential information disclosure, denial of service, and remote code execution vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id121246
    published2019-01-18
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121246
    titleFoxit PhantomPDF < 8.3.9 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(121246);
      script_version("1.4");
      script_cvs_date("Date: 2019/10/31 15:18:52");
    
      script_cve_id(
        "CVE-2018-3956",
        "CVE-2018-18688",
        "CVE-2018-18689",
        "CVE-2019-5005",
        "CVE-2019-5006",
        "CVE-2019-5007",
        "CVE-2019-6727",
        "CVE-2019-6728",
        "CVE-2019-6729",
        "CVE-2019-6730",
        "CVE-2019-6731",
        "CVE-2019-6732",
        "CVE-2019-6733",
        "CVE-2019-6734",
        "CVE-2019-6735"
      );
      script_bugtraq_id(106798, 107496, 107552);
      script_xref(name:"ZDI", value:"ZDI-CAN-7347");
      script_xref(name:"ZDI", value:"ZDI-CAN-7452");
      script_xref(name:"ZDI", value:"ZDI-CAN-7601");
      script_xref(name:"ZDI", value:"ZDI-CAN-7353");
      script_xref(name:"ZDI", value:"ZDI-CAN-7423");
      script_xref(name:"ZDI", value:"ZDI-CAN-7368");
      script_xref(name:"ZDI", value:"ZDI-CAN-7369");
      script_xref(name:"ZDI", value:"ZDI-CAN-7453");
      script_xref(name:"ZDI", value:"ZDI-CAN-7576");
      script_xref(name:"ZDI", value:"ZDI-CAN-7355");
    
      script_name(english:"Foxit PhantomPDF < 8.3.9 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Foxit PhantomPDF.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A PDF toolkit installed on the remote Windows host is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "According to its version, the Foxit PhantomPDF application (formally
    known as Phantom) installed on the remote Windows host is prior to
    8.3.9. It is, therefore, affected by following vulnerabilities:
    
      - An out-of-bounds read/write vulnerability exists
        when handling certain XFA element attributes.
        This occurs due to improper calculation of a
        null-terminated character and may cause an application crash.
        (CVE-2018-3956)
    
      - A signature validation bypass vulnerability exists
        which provides incorrect results when validating
        certain PDF documents.
        (CVE-2018-18688/CVE-2018-18689)
    
      - Flaws in how PDF files are processed/handled could
        lead to arbitrary code execution. An attacker can 
        exploit this by convincing a user to open a specially
        crafted file in order to cause the execution of arbitrary
        code. (CVE-2019-6728,CVE-2019-6729)
    
    Additionally, the application was affected by multiple potential 
    information disclosure, denial of service, and remote code execution
    vulnerabilities.");
      # https://www.foxitsoftware.com/support/security-bulletins.php
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2f244c3e");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Foxit PhantomPDF version 8.3.9 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6729");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/01/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/18");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantom");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantompdf");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("foxit_phantom_installed.nasl");
      script_require_keys("installed_sw/FoxitPhantomPDF");
    
      exit(0);
    }
    
    include('vcf.inc');
    
    app = 'FoxitPhantomPDF';
    
    app_info = vcf::get_app_info(app:app, win_local:TRUE);
    
    constraints = [{
      'min_version' : '8.0',
      'max_version' : '8.3.8.39677',
      'fixed_version' : '8.3.9'
      }];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    
  • NASL familyWindows
    NASL idFOXIT_READER_9_4.NASL
    descriptionThe version of Foxit Reader installed on the remote Windows host is prior to 9.4. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds read/write vulnerability and crash when handling XFA element attributes. (CVE-2018-3956) - A signature validation bypass vulnerability which could lead to incorrect validation results. (CVE-2018-18688, CVE-2018-18689) - Flaws in how PDF files are processed/handled could lead to arbitrary code execution. An attacker can exploit this by convincing a user to open a specially crafted file in order to cause the execution of arbitrary code. (CVE-2019-6728,CVE-2019-6729) Additionally, the application was affected by multiple potential information disclosure, denial of service, and remote code execution vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id121046
    published2019-01-09
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121046
    titleFoxit Reader < 9.4 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(121046);
      script_version("1.6");
      script_cvs_date("Date: 2019/10/31 15:18:52");
    
      script_cve_id(
        "CVE-2018-3956",
        "CVE-2018-18688",
        "CVE-2018-18689",
        "CVE-2019-5005",
        "CVE-2019-5006",
        "CVE-2019-5007",
        "CVE-2019-6727",
        "CVE-2019-6728",
        "CVE-2019-6729",
        "CVE-2019-6730",
        "CVE-2019-6731",
        "CVE-2019-6732",
        "CVE-2019-6733",
        "CVE-2019-6734",
        "CVE-2019-6735"
      );
      script_bugtraq_id(106798, 107496, 107552);
    
      script_name(english:"Foxit Reader < 9.4 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Foxit Reader.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A PDF viewer installed on the remote Windows host is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Foxit Reader installed on the remote Windows host is
    prior to 9.4. It is, therefore, affected by multiple vulnerabilities:
    
      - An out-of-bounds read/write vulnerability and crash
        when handling XFA element attributes. (CVE-2018-3956)
    
      - A signature validation bypass vulnerability which
        could lead to incorrect validation results.
        (CVE-2018-18688, CVE-2018-18689)
    
      - Flaws in how PDF files are processed/handled could
        lead to arbitrary code execution. An attacker can 
        exploit this by convincing a user to open a specially
        crafted file in order to cause the execution of arbitrary
        code. (CVE-2019-6728,CVE-2019-6729)
    
    Additionally, the application was affected by multiple potential 
    information disclosure, denial of service, and remote code execution
    vulnerabilities.");
      script_set_attribute(attribute:"see_also", value:"https://www.foxitsoftware.com/support/security-bulletins.php");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Foxit PhantomPDF version 9.4 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6729");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/03");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/01/03");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/09");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:foxit_reader");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("foxit_reader_installed.nasl");
      script_require_keys("installed_sw/Foxit Reader");
    
      exit(0);
    }
    
    include('vcf.inc');
    
    app = 'Foxit Reader';
    
    app_info = vcf::get_app_info(app:app, win_local:TRUE);
    
    constraints = [{
      'min_version' : '9.0',
      'max_version' : '9.3.0.10826',
      'fixed_version' : '9.4'
      }];
      
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    
  • NASL familyWindows
    NASL idFOXIT_PHANTOM_9_4.NASL
    descriptionAccording to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 9.4. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds read/write vulnerability and crash when handling XFA element attributes. (CVE-2018-3956) - A signature validation bypass vulnerability which could lead to incorrect validation results. (CVE-2018-18688, CVE-2018-18689) - Flaws in how PDF files are processed/handled could lead to arbitrary code execution. An attacker can exploit this by convincing a user to open a specially crafted file in order to cause the execution of arbitrary code. (CVE-2019-6728,CVE-2019-6729) Additionally, the application was affected by multiple potential information disclosure, denial of service, and remote code execution vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id121045
    published2019-01-09
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121045
    titleFoxit PhantomPDF < 9.4 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(121045);
      script_version("1.6");
      script_cvs_date("Date: 2019/10/31 15:18:52");
    
      script_cve_id(
        "CVE-2018-3956",
        "CVE-2018-18688",
        "CVE-2018-18689",
        "CVE-2019-5005",
        "CVE-2019-5006",
        "CVE-2019-5007",
        "CVE-2019-6727",
        "CVE-2019-6728",
        "CVE-2019-6729",
        "CVE-2019-6730",
        "CVE-2019-6731",
        "CVE-2019-6732",
        "CVE-2019-6733",
        "CVE-2019-6734",
        "CVE-2019-6735"
      );
      script_bugtraq_id(106798, 107496, 107552);
    
      script_name(english:"Foxit PhantomPDF < 9.4 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Foxit PhantomPDF.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A PDF toolkit installed on the remote Windows host is affected by
    a multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "According to its version, the Foxit PhantomPDF application (formally
    known as Phantom) installed on the remote Windows host is prior to
    9.4. It is, therefore, affected by multiple vulnerabilities:
    
      - An out-of-bounds read/write vulnerability and crash
        when handling XFA element attributes. (CVE-2018-3956)
    
      - A signature validation bypass vulnerability which
        could lead to incorrect validation results.
        (CVE-2018-18688, CVE-2018-18689)
    
      - Flaws in how PDF files are processed/handled could
        lead to arbitrary code execution. An attacker can 
        exploit this by convincing a user to open a specially
        crafted file in order to cause the execution of arbitrary
        code. (CVE-2019-6728,CVE-2019-6729)
    
    Additionally, the application was affected by multiple potential 
    information disclosure, denial of service, and remote code execution
    vulnerabilities.");
      script_set_attribute(attribute:"see_also", value:"https://www.foxitsoftware.com/support/security-bulletins.php");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Foxit PhantomPDF version 9.4 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6729");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/03");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/01/03");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/09");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantom");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:foxitsoftware:phantompdf");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("foxit_phantom_installed.nasl");
      script_require_keys("installed_sw/FoxitPhantomPDF");
    
      exit(0);
    }
    
    include('vcf.inc');
    
    app = 'FoxitPhantomPDF';
    
    app_info = vcf::get_app_info(app:app, win_local:TRUE);
    
    constraints = [{
      'min_version' : '9.0',
      'max_version' : '9.3.0.10826',
      'fixed_version' : '9.4'
      }];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);