Foxit PhantomPDF AFParseDateEx information disclosure

Summaryinfo

A vulnerability identified as problematic has been detected in Foxit PhantomPDF. The impacted element is the function AFParseDateEx. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2019-6732. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Foxit PhantomPDF (affected version not known). It has been rated as problematic. This issue affects the function AFParseDateEx. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the AFParseDateEx method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7453.

The bug was discovered 01/25/2019. The weakness was shared 03/21/2019. The identification of this vulnerability is CVE-2019-6732 since 01/24/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 55 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-132031, VDB-132030 and VDB-132028 are related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Foxit

Name

• PhantomPDF

License

• free

Website

• Vendor: https://www.foxitsoftware.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion