Foxit 3D Plugin Beta < 9.7.2.29539 RCE

high Nessus Plugin ID 139233

Language:

Synopsis

The remote Windows host has a Foxit plugin installed that is affected by a remote code execution vulnerability.

Description

The version of the Foxit 3D plugin installed on the remote Windows host is prior to 9.7.2.29539. It is, therefore affected by an Out-of-Bounds Read/Write or Heap-based Buffer Overflow vulnerability due to improper validation of data when parsing certain file with incorrect 3D annotation data. An unauthenticated, remote attacker can exploit this to disclose information or execute remote code.

Solution

Upgrade to Foxit 3D Plugin Beta 9.7.2.29539 or later

Plugin Details

Severity: High

ID: 139233

File Name: foxit_3d_plugin_beta_9_7_2_29539.nasl

Version: 1.1

Type: local

Agent: windows

Family: Windows

Published: 7/31/2020

Updated: 7/31/2020

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS Score Rationale: Score based on analysis of the vendor advisory.

CVSS v2

Risk Factor: High

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: manual

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: x-cpe:/a:foxitsoftware:u3dbrowser_plugin

Required KB Items: installed_sw/Foxit U3DBrowser Plugin

Patch Publication Date: 4/16/2020

Vulnerability Publication Date: 4/16/2020

Detections

Analytics