Foxit acknowledges zero-days in its PDF software, but no patches yet
Popular PDF tool Foxit Reader has two zero-day vulnerabilities that, if exploited, could give attackers the ability to execute malicious vbscript code on startup.
The vulnerabilities, publicly exposed by the Zero Day Initiatives and AusCERT, affect all versions of Foxit Reader and Foxit PhantomPDF.
The first vulnerability, CVE-2017-10951, is a zero-day involving Foxit Reader's launchURL Command Injection Remote Code Vulnerability.
According to AusCERT, user interaction such as going to a malicious page or opening a malicious file is required to exploit the vulnerability, which was flagged by security researchers.
“The specific flaw exists within app.launchURL method. The issue result from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process,” a statement from AusCERT says.
Foxit will not be issuing a patch for the vulnerability. It instead released a statement that encourages users to use “Safe Reading Mode”.
AusCERT says that the only useful mitigation strategy is to only use Foxit with trusted files.
The second vulnerability, CVE-2017-10952, is a zero-day involving Foxit's Arbitrary File Write Remote Code Execution Vulnerability.
“The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerability to execute code under the context of the current process,” AusCERT states.
Foxit Reader is not patching this vulnerability either, and once again suggests that Safe Reading is the answer.
AusCERT also says that for this vulnerability, people should only use Foxit Reader for trusted files.