module
Foxit PDF Reader Pointer Overwrite UAF
| Disclosed |
|---|
| Apr 20, 2018 |
Disclosed
Apr 20, 2018
Description
Foxit PDF Reader v9.0.1.1049 has a Use-After-Free vulnerability
in the Text Annotations component and the TypedArray's use
uninitialized pointers.
The vulnerabilities can be combined to leak a vtable memory address,
which can be adjusted to point to the base address of the executable.
A ROP chain can be constructed that will execute when Foxit Reader
performs the UAF.
This module has been tested on Windows 7 x64, Windows 10 Pro x64
Build 17134, and Windows 10 Enterprise x64. Windows 10 Enterprise
must have insecure logons enabled for the exploit to work as expected.
in the Text Annotations component and the TypedArray's use
uninitialized pointers.
The vulnerabilities can be combined to leak a vtable memory address,
which can be adjusted to point to the base address of the executable.
A ROP chain can be constructed that will execute when Foxit Reader
performs the UAF.
This module has been tested on Windows 7 x64, Windows 10 Pro x64
Build 17134, and Windows 10 Enterprise x64. Windows 10 Enterprise
must have insecure logons enabled for the exploit to work as expected.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.