Summaryinfo

A vulnerability was found in Real Software TinyPDF. It has been rated as problematic. This affects an unknown function of the file InstallTinyPDF.exe of the component Installer. This manipulation causes privileges management. The attack is restricted to local execution. No exploit exists. It is recommended to apply the suggested workaround.

Detailsinfo

A vulnerability has been found in Real Software TinyPDF (version unknown) and classified as problematic. Affected by this vulnerability is an unknown function of the file InstallTinyPDF.exe of the component Installer. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was disclosed 01/02/2017 by Stefan Kanthak as Executable installers are vulnerable^WEVIL (case 45): ReadPDF's installers allow escalation of privilege as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The vendor was not involved in the public release. Attacking locally is a requirement. The successful exploitation requires a single authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 1684 days. During that time the estimated underground price was around $0-$5k.

The best possible mitigation is suggested to be Workaround. The mailinglist post contains the following remark:

Write a windows-conformant .INF to install the printer driver (see <http://home.arcor.de/skanthak/download/TINYPDF.INF>), then use MakeCAT.exe to create a .CAT and SignTool.exe to sign it.

The entry VDB-94928 is pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Real Software

Name

• TinyPDF

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion