Foxit Software released security updates to fix a high severity remote code execution (RCE) vulnerability in its highly popular Foxit reader.
This security flaw could allow attackers to run malicious code on users’ Windows computers and potentially, take over control.
Foxit claims to have more than 650 million users from 200 countries, with its software currently being used by over 100,000 customers.
The company’s enterprise customer list includes multiple high-profile tech companies such as Google, Intel, NASDAQ, Chevron, British Airways, Dell, HP, Lenovo, and Asus.
The high-severity vulnerability tracked as CVE-2021-21822 results from a Use After Free bug found by Aleksandar Nikolic of Cisco Talos in the V8 JavaScript engine used by Foxit Reader to display dynamic forms and interactive document elements.
On successful exploitation of the bugs, it can lead to unexpected results ranging from program crashes and data corruption to the execution of arbitrary code on computers running the vulnerable software.
This security flaw is caused by how the Foxit Reader application and browser extensions handle certain annotation types, which attackers can abuse to craft malicious PDFs that will allow them to run arbitrary code via precise memory control.
Nikolic stated that a specially crafted PDF document can trigger the reuse of previously free memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening a malicious file or site to trigger this vulnerability if the browser plugin extension is enabled.
The vulnerability affects Foxit Reader 10.1.3.37598 and earlier versions, and it was addressed with the release of Foxit Reader 10.1.4.37651.
In order to prevent being attacked, the users are recommended to download the latest Foxit Reader version and then click on “Check for Updates” in the app’s “Help” dialog.
With the release of Foxit Reader 10.1.4, several other security bugs impacting previous Foxit Reader versions has also been fixed. This includes exposing users’ devices to denial of service, remote code execution, information disclosure, SQL injection, DLL hijacking, and other vulnerabilities.
The list of security fixes in the Foxit Reader 10.1.4 release includes
Issues where the application could be exposed to :
- Memory Corruption vulnerability and crash when exporting certain PDF files to other formats.
- Denial of Service vulnerability and crash when handling certain XFA forms or link objects.
- Denial of Service, Null Pointer Reference, Out-of-Bounds Read, Context Level Bypass, Type Confusion, or Buffer Overflow vulnerability and crash, which could be exploited by attackers to execute remote code.
- Arbitrary File Deletion vulnerability due to improper access control.
- DLL Hijacking vulnerability when it was launched, which could be exploited by attackers to execute remote code by placing a malicious DLL in the specified path directory.
- Out-of-Bounds Write/Read Remote Code Execution or Information Disclosure vulnerability and crash when handling certain JavaScripts or XFA forms.
- Out-of-Bounds Write vulnerability when parsing certain PDF files that contain nonstandard /Size key value in the Trailer dictionary.
- Out-of-Bounds, Write vulnerability and crash when converting certain PDF files to Microsoft Office files.
- Arbitrary File Write Remote Code Execution vulnerability when executing certain JavaScripts.
- SQL Injection Remote Code Execution vulnerability.
- Uninitialized Variable Information Disclosure vulnerability and crash.
- Out-of-Bounds Read or Heap-based Buffer Overflow vulnerability and crash, which could be exploited by attackers to execute remote code or disclose sensitive information.
Issue where the application could deliver incorrect signature information for certain PDF files that contained invisible digital signatures.
