PT-2020-14966 · Foxit · Foxit Phantompdf

Mat Powell · Published 2020-09-29 · Updated 2020-10-15 · CVE-2020-17415

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foxit PhantomPDF version 10.0.0.35798

Description This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the handling of configuration files used by the Foxit PhantomPDF Update Service, resulting from incorrect permissions set on a resource used by the service. An attacker can leverage this to escalate privileges and execute code in the context of SYSTEM.

Recommendations For Foxit PhantomPDF version 10.0.0.35798, update to a version where the Foxit PhantomPDF Update Service has correct permission assignments to prevent privilege escalation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2020-17415

ZDI-20-1232

Affected Products

Foxit Phantompdf

References · 4

• https://osv.dev/vulnerability/CVE-2020-17415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17415 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-1232 · Security Note
• https://foxitsoftware.com/support/security-bulletins.php · Vendor Advisory