Nitro Pro 10.5.7.32 / Nitro Reader 5.5.3.1 – Heap Memory Corruption

• Exploit Database
• 114 阅读

• 作者： Francis Provencher
  日期： 2016-03-10
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/39546/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72

  #####################################################################################   Application: Nitro PDF   Platforms: Windows   Versions: Nitro Pro 10.5.7.32 and lower& Nitro Reader 5.5.3.1 and lower   Author: Francis Provencher of COSIG   Website: http://www.protekresearchlab.com/   Twitter: @COSIG_ @protekresearch   #####################################################################################   1) Introduction 2) Report Timeline 3) Technical details 4) POC   #####################################################################################   =============== 1) Introduction ===============   Nitro develops commercial software used to create, edit, sign, and secure Portable Document Format (PDF) files and digital documents. The Nitro ecosystem consists of Nitro Pro, Nitro Cloud, Nitro Reader, and a suite of document conversion sites.   Nitro’s product family is intended for the professional market and although its desktop products are Windows-only, Nitro Cloud is compatible with any web browser on any machine. The Nitro PDF Reader is freeware for both personal and professional use.   (https://en.wikipedia.org/wiki/Nitro_PDF)   #####################################################################################   ============================ 2) Report Timeline ============================   2015-12-29: Francis Provencher from COSIG report issue to GoNitro sales team; 2016-01-02: GoNitro confirmed this issue; 2016-01-21: GoNitro fixed this issue;   https://www.gonitro.com/support/security-update #####################################################################################   ============================ 3) Technical details ============================   This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Nitro PDF 10 (10.5.7.32). User interaction is required to exploit this vulnerability in that the target must open a malicious file.   A specially crafted PDF with a specific FunctionType 0 and an invalid /Domain can force an heap memory corruption   by pointing to an uninitialized space of memory.An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process.1   .   #####################################################################################   ===========   4) POC   ===========   http://protekresearchlab.com/exploits/COSIG-2016-13.pdf https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39546.zip   ###############################################################################