Foxit Reader 9.3.0.10826 u3d plugin plugins\U3DBrowser.fpi basic_ostream out-of-bounds

Summaryinfo

A vulnerability categorized as critical has been discovered in Foxit Reader 9.3.0.10826. This issue affects the function FoxitReader!std::basic_ostream of the file plugins\U3DBrowser.fpi of the component u3d plugin. Executing a manipulation can lead to out-of-bounds. This vulnerability appears as CVE-2018-19341. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Foxit Reader 9.3.0.10826 (Document Reader Software). It has been declared as critical. This vulnerability affects the function FoxitReader!std::basic_ostream of the file plugins\U3DBrowser.fpi of the component u3d plugin. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader!std::basic_ostream >::operator<<+0x0000000000087906" issue.

The bug was discovered 11/10/2018. The weakness was presented 11/17/2018 (Website). The advisory is shared for download at github.com. This vulnerability was named CVE-2018-19341 since 11/17/2018. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-126989, VDB-126990, VDB-126991 and VDB-126992 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Document Reader Software

Vendor

• Foxit

Name

• Reader

Version

• 9.3.0.10826

License

• free

Website

• Vendor: https://www.foxitsoftware.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion