PT-2016-7597 · Foxit · Foxit Reader

Publicado 2016-10-31 · Atualizado 2017-07-29 · CVE-2016-8856

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit Reader for Mac versions 2.1.0.0804 and earlier Foxit Reader for Linux versions 2.1.0.0805 and earlier

Description The issue is related to weak file permissions that could be exploited by attackers to execute arbitrary code. After installation, Foxit Reader's core files are world-writable by default, allowing an attacker to overwrite them with backdoor code. This could result in Privilege Escalation or Code Execution when executed by a privileged user.

Recommendations For Foxit Reader for Mac versions 2.1.0.0804 and earlier, update to a version later than 2.1.0.0804 to resolve the issue. For Foxit Reader for Linux versions 2.1.0.0805 and earlier, update to a version later than 2.1.0.0805 to resolve the issue. As a temporary workaround, consider changing the file permissions of Foxit Reader's core files to prevent them from being world-writable.

Correção

Enumeração de Fraquezas

CWE-275

Identificadores relacionados

CVE-2016-8856

Produtos afetados

Foxit Reader

Referências · 5

• http://securitytracker.com/id/1037101 · Nota
• https://osv.dev/vulnerability/CVE-2016-8856 · Aviso do Fabricante
• http://securityfocus.com/bid/93608 · Nota
• https://foxitsoftware.com/support/security-bulletins.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-8856 · Nota de Segurança