Two recently addressed vulnerabilities in the Nitro Pro PDF editor could be exploited by malicious actors to execute code remotely on affected hosts, according to Cisco’s Talos threat intelligence and research group.
Nitro Pro is a piece of software designed for reading, editing, signing, and saving PDF files. It is part of Nitro Software’s suite of enterprise tools, which the company claims to be helping more than 10,000 organizations boost productivity.
Security researchers with Cisco Talos identified three vulnerabilities in the PDF application, two of which could be exploited for remote code execution, both featuring a CVSS score of 8.8.
Tracked as CVE-2020-6074, the first of these flaws was identified in the PDF parser of Nitro Pro. An attacker looking to exploit the bug needs to provide the victim with a specially crafted PDF to trigger a use-after-free and achieve code execution.
The second security issue is tracked as CVE-2020-6092 and resides in the manner in which Nitro Pro parses Pattern objects. An attacker needs to craft a PDF file and lure the victim into opening it to trigger an integer overflow and then achieve remote code execution.
Cisco’s security researchers also identified an information disclosure vulnerability in the application. Tracked as CVE-2020-6093 and carrying a CVSS score of 6.5, the bug is related to the way Nitro Pro does XML error handling.
To exploit the flaw, an adversary would need to deliver a specially crafted PDF document to the victim and entice them into opening the file. This would cause uninitialized memory access that could be exploited to leak information.
All three vulnerabilities were found in Nitro Pro version 13.9.1.155 and were reported to the vendor in February. A security update to address these issues was released in early May and users are advised to install it to remain protected.
Related: Critical Flaw in CODESYS Industrial Controller Software Allows Code Execution
Related: Videolabs Patches Code Execution, DoS Vulnerabilities in libmicrodns Library
Related: Multiple Vulnerabilities Found in AMD ATI Radeon Graphics Cards
Related: Remote Code Execution Flaw Impacts E2fsprogs Filesystem Utility
