ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
71 lines
No EOL
2.6 KiB
Text
71 lines
No EOL
2.6 KiB
Text
#####################################################################################
|
||
|
||
Application: Nitro PDF
|
||
|
||
Platforms: Windows
|
||
|
||
Versions: Nitro Pro 10.5.7.32 and lower & Nitro Reader 5.5.3.1 and lower
|
||
|
||
Author: Francis Provencher of COSIG
|
||
|
||
Website: http://www.protekresearchlab.com/
|
||
|
||
Twitter: @COSIG_ @protekresearch
|
||
|
||
#####################################################################################
|
||
|
||
1) Introduction
|
||
2) Report Timeline
|
||
3) Technical details
|
||
4) POC
|
||
|
||
#####################################################################################
|
||
|
||
===============
|
||
1) Introduction
|
||
===============
|
||
|
||
Nitro develops commercial software used to create, edit, sign, and secure Portable Document Format (PDF) files and digital documents. The Nitro ecosystem consists of Nitro Pro, Nitro Cloud, Nitro Reader, and a suite of document conversion sites.
|
||
|
||
Nitro’s product family is intended for the professional market and although its desktop products are Windows-only, Nitro Cloud is compatible with any web browser on any machine. The Nitro PDF Reader is freeware for both personal and professional use.
|
||
|
||
(https://en.wikipedia.org/wiki/Nitro_PDF)
|
||
|
||
#####################################################################################
|
||
|
||
============================
|
||
2) Report Timeline
|
||
============================
|
||
|
||
2015-12-29: Francis Provencher from COSIG report issue to GoNitro sales team;
|
||
2016-01-02: GoNitro confirmed this issue;
|
||
2016-01-21: GoNitro fixed this issue;
|
||
|
||
https://www.gonitro.com/support/security-update
|
||
#####################################################################################
|
||
|
||
============================
|
||
3) Technical details
|
||
============================
|
||
|
||
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Nitro PDF 10 (10.5.7.32).
|
||
User interaction is required to exploit this vulnerability in that the target must open a malicious file.
|
||
|
||
A specially crafted PDF with a specific FunctionType 0 and an invalid /Domain can force an heap memory corruption
|
||
|
||
by pointing to an uninitialized space of memory.An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process.1
|
||
|
||
.
|
||
|
||
#####################################################################################
|
||
|
||
===========
|
||
|
||
4) POC
|
||
|
||
===========
|
||
|
||
http://protekresearchlab.com/exploits/COSIG-2016-13.pdf
|
||
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39546.zip
|
||
|
||
############################################################################### |