Two recently addressed vulnerabilities in the Nitro Pro PDF editor could be exploited by malicious actors to execute code remotely on affected hosts, according to Cisco’s Talos threat intelligence and research group.
Nitro Pro is a piece of software designed for reading, editing, signing, and saving PDF files. It is part of Nitro Software’s suite of enterprise tools, which the company claims to be helping more than 10,000 organizations boost productivity.
Security researchers with Cisco Talos identified three vulnerabilities in the PDF application, two of which could be exploited for remote code execution, both featuring a CVSS score of 8.8.
Tracked as CVE-2020-6074, the first of these flaws was identified in the PDF parser of Nitro Pro. An attacker looking to exploit the bug needs to provide the victim with a specially crafted PDF to trigger a use-after-free and achieve code execution.
The second security issue is tracked as CVE-2020-6092 and resides in the manner in which Nitro Pro parses Pattern objects. An attacker needs to craft a PDF file and lure the victim into opening it to trigger an integer overflow and then achieve remote code execution.
Cisco’s security researchers also identified an information disclosure vulnerability in the application. Tracked as CVE-2020-6093 and carrying a CVSS score of 6.5, the bug is related to the way Nitro Pro does XML error handling.
To exploit the flaw, an adversary would need to deliver a specially crafted PDF document to the victim and entice them into opening the file. This would cause uninitialized memory access that could be exploited to leak information.
All three vulnerabilities were found in Nitro Pro version 13.9.1.155 and were reported to the vendor in February. A security update to address these issues was released in early May and users are advised to install it to remain protected.
Related: Critical Flaw in CODESYS Industrial Controller Software Allows Code Execution
Related: Videolabs Patches Code Execution, DoS Vulnerabilities in libmicrodns Library
Related: Multiple Vulnerabilities Found in AMD ATI Radeon Graphics Cards
Related: Remote Code Execution Flaw Impacts E2fsprogs Filesystem Utility
More from Ionut Arghire
- Software Supply Chain Security Firm Lineaje Raises $7 Million
- Vulnerability Provided Access to Toyota Supplier Management Network
- Linux Variant of Cl0p Ransomware Emerges
- New York Attorney General Fines Vendor for Illegally Promoting Spyware
- 20 Million Users Impacted by Data Breach at Instant Checkmate, TruthFinder
- Florida Hospital Cancels Procedures, Diverts Patients Following Cyberattack
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Atlassian Warns of Critical Jira Service Management Vulnerability
Latest News
- Germany Appoints Central Bank IT Chief to Head Cybersecurity
- OpenSSL Ships Patch for High-Severity Flaws
- Software Supply Chain Security Firm Lineaje Raises $7 Million
- ICS Cybersecurity Firm Opscura Launches With $9.4 Million in Series A Funding
- Vulnerability Provided Access to Toyota Supplier Management Network
- Patch Released for Actively Exploited GoAnywhere MFT Zero-Day
- Linux Variant of Cl0p Ransomware Emerges
- VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
