More doc updates
parent
88c908665d
commit
d5ad683ba6
|
@ -1,6 +1,6 @@
|
|||
## Description
|
||||
|
||||
Foxit Reader v9.0.1.1049 and earlier are affected by use-after-free and uninitialzed memory vulnerabilities that can be used to gain code execution. This module uses Uint32Array uninitialized memory and text annotation use-after-free vulnerabilities to call WinExec with a share file path to download and execute the specified exe. The module has been tested against Foxit Reader v9.0.1.1049 running on Windows 7 x64 and Windows 10 Pro x64 Build 17134. Later builds of Windows 10 Pro x64 may need insecure logons enabled for the module to work.
|
||||
Foxit Reader v9.0.1.1049 and earlier are affected by use-after-free and uninitialzed memory vulnerabilities that can be used to gain code execution. This module uses Uint32Array uninitialized memory and text annotation use-after-free vulnerabilities to call WinExec with a share file path to download and execute the specified exe. The module has been tested against Foxit Reader v9.0.1.1049 running on Windows 7 x64 and Windows 10 Pro x64 Build 17134. Windows 10 Enterprise needs to have [insecure logons enabled](https://support.microsoft.com/en-ca/help/4046019) for the exploit to work as expected.
|
||||
|
||||
## Vulnerable Application
|
||||
|
||||
|
|
|
@ -20,6 +20,10 @@ class MetasploitModule < Msf::Exploit::Remote
|
|||
which can be adjusted to point to the base address of the executable.
|
||||
A ROP chain can be constructed that will execute when Foxit Reader
|
||||
performs the UAF.
|
||||
|
||||
This module has been tested on Windows 7 x64, Windows 10 Pro x64
|
||||
Build 17134, and Windows 10 Enterprise x64. Windows 10 Enterprise
|
||||
must have insecure logons enabled for the exploit to work as expected.
|
||||
},
|
||||
'License' => MSF_LICENSE,
|
||||
'Author' =>
|
||||
|
|
Loading…
Reference in New Issue