Advisories » Foxit Reader "util.printf()" Remote Buffer Overflow Vulnerability

 

Release Date:	20/05/2008	Severity:	Highly Critical
SecWatch Advisory:	SWID1021240	Cause:	Boundary error
Solution Status:	Unpatched	Impact:	Execution of arbitrary code
Exploit Status:	None Available	Access Vector:	From remote
Affected Software:	Foxit Reader 2.x
Original Advisory:	http://secunia.com/secunia_research/2008-18/
References:	FrSIRT/ADV-2008-1572
CVE:	CVE-2008-1104
Secunia:	SA29941
Bugtraq ID:	BID#29288

 

Description:

A vulnerability in Foxit Reader has been reported, which can be exploited by remote users to compromise a user's system.

A boundary error exists when parsing crafted PDF files within the "util.printf()" JavaScript function, which can be exploited to cause a stack-based buffer overflow and execute arbitrary code.

 

Affected:

Foxit Reader version 2.3 build 2825. Other versions may also be affected.

 

Solution:

The vulnerability is fixed in upcoming version 2.3 build 2912.

 

Credits:

Secunia Research

 

Free Vulnerability Notification Service

Receive free instant and customisable notifications of new vulnerabilities or exploits via e-mail, web or RSS feeds. Click here for more information.

 

Related Vulnerabilities and Exploits

23 Apr 08: Foxit Reader PDF "ExtGState" and "XObject" Processing Remote Memo..

23 Apr 07: Foxit Reader 2.0 PDF Handling Remote Denial of.. (FoxitReader_DoS.cpp)