PT-2020-2732 · Nitro · Nitro Pro

Published 2020-02-17 · Updated 2022-05-12 · CVE-2020-6092

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nitro Pro version 13.9.1.155

Description The issue is related to the parsing of Pattern objects in Nitro Pro, which can be exploited through a specially crafted PDF file. This exploitation can trigger an integer overflow, potentially leading to arbitrary code execution. The victim must open a malicious file to trigger this issue. The vulnerability is associated with an integer buffer overflow in the /Pattern component of the Nitro Pro application, allowing a remote attacker to execute arbitrary code using a specially formed PDF file.

Recommendations For Nitro Pro version 13.9.1.155, consider avoiding the use of the /Pattern component until a patch is available. As a temporary workaround, refrain from opening suspicious or untrusted PDF files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2020-02808

CVE-2020-6092

Affected Products

Nitro Pro

References · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1013 · Exploit
• https://osv.dev/vulnerability/CVE-2020-6092 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6092 · Security Note
• https://bdu.fstec.ru/vul/2020-02808 · Security Note