CVE-2011-10030highCWE-73

Foxit PDF Reader < 4.3.1.0218 JavaScript File Write

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 8.4epss 0.4%

da publicação à arma0 dias

Publicada no NVD20 de ago.

metasploit5 de mar.

probabilidade de exploração

0.4%top 69% das CVEs

exploração observada

nãonenhuma fonte reporta

Foxit PDF Reader < 4.3.1.0218 exposes a JavaScript API function, createDataObject(), that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code execution the next time the system boots or the user logs in.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

Foxit Software · Foxit PDF Reader

Referências

http://scarybeastsecurity.blogspot.com/2011/03/dangerous-file-write-bug-in-foxit-pdf.html https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/foxit_reader_filewrite.rb https://scarybeastsecurity.blogspot.com/2011/03/dangerous-file-write-bug-in-foxit-pdf.html https://www.exploit-db.com/exploits/16978 https://www.foxit.com/pdf-reader/version-history.html https://www.vulncheck.com/advisories/foxit-pdf-reader-javascript-file-write