Foxit 3D Plugin Beta < 9.7.2.29539 RCE

High Nessus Plugin ID 139233

Synopsis

The remote Windows host has a Foxit plugin installed that is affected by a remote code execution vulnerability.

Description

The version of the Foxit 3D plugin installed on the remote Windows host is prior to 9.7.2.29539. It is, therefore affected by an Out-of-Bounds Read/Write or Heap-based Buffer Overflow vulnerability due to improper validation of data when parsing certain file with incorrect 3D annotation data. An unauthenticated, remote attacker can exploit this to disclose information or execute remote code.

Solution

Upgrade to Foxit 3D Plugin Beta 9.7.2.29539 or later

See Also

http://www.nessus.org/u?2f244c3e

Plugin Details

Severity: High

ID: 139233

File Name: foxit_3d_plugin_beta_9_7_2_29539.nasl

Version: 1.1

Type: local

Agent: windows

Family: Windows

Published: 2020/07/31

Updated: 2020/07/31

Dependencies: 132586

Risk Information

Risk Factor: High

CVSS Score Source: manual

CVSS Score Rationale: Score based on analysis of the vendor advisory.

CVSS v2.0

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS v3.0

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: x-cpe:/a:foxitsoftware:u3dbrowser_plugin

Required KB Items: installed_sw/Foxit U3DBrowser Plugin

Patch Publication Date: 2020/04/16

Vulnerability Publication Date: 2020/04/16