CVE-2018-9959: Use After Free
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of the pageNum document attribute. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5432.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Foxit Readerto a version that resolves this vulnerability.Fixed in 9.0.1.1049Patch ZDI-CAN-5432
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must induce the target to visit a malicious page or open a malicious file. Exploitation is remote and requires no attacker privileges, but it does require user interaction.
What level of access could successful exploitation provide?
Successful exploitation can execute arbitrary code in the context of the current Foxit Reader or PhantomPDF process. The stated impact includes high confidentiality, integrity, and availability impact.
Which product version is explicitly identified as vulnerable?
Foxit Reader 9.0.1.1049 is explicitly identified as a vulnerable installation. Foxit PhantomPDF is also listed as affected software, but no specific PhantomPDF version is provided.
What flaw should defenders look for when assessing related exposure?
The issue is a use-after-free condition in parsing the pageNum document attribute. It results from operating on an object without validating that the object exists.