Foxit patches critical vulnerability in PDF viewer browser plug-in

The vulnerability had been publicly known for a over a week

Foxit released version 5.4.5 of its Foxit Reader PDF viewer plug-in on Thursday in order to address a critical remote code execution vulnerability that could have allowed attackers to compromise computers running previous versions of the software.

The vulnerability was located in the Foxit Reader browser plug-in for Mozilla Firefox, Google Chrome, Opera and Safari and could have been exploited by tricking users into opening an URL to a PDF document with an extremely long file name. The plug-in -- npFoxitReaderPlugin.dll -- is installed by default unless users clear a checkbox during the Foxit Reader installation process.

Foxit Reader 5.4.5 contains a patched version of the browser plug-in, Foxit said in an advisory published on its website. Users are advised to upgrade to the newly released version by using the "Check for Updates Now" link under the application's "Help" menu.

In its advisory, Foxit credits vulnerability research firm Secunia with discovering the flaw. However the vulnerability was actually found by independent security researcher Andrea Micalizzi.

Micalizzi publicly disclosed details about the vulnerability and how it can be exploited on his website on Jan. 7, meaning that it had zero-day -- publicly known, but unpatched -- status at the time. Secunia credited Micalizzi in its own advisory on Jan. 8.

Foxit Reader has often been advanced in the past as a safer alternative to Adobe Reader. Foxit advertises the application as "the most secure PDF reader" on its website and claims that it has over 130 million users.

PDF exploits are not as commonly used in Web-based attacks today as they were a few years ago. However, many Web exploit toolkits used by cybercriminals still contain such exploits, the vast majority of which target vulnerabilities in outdated versions of Adobe Reader.

Newer versions of Adobe Reader like Adobe Reader X (10) and XI (11) have a sandboxing mechanism that makes the exploitation of remote code execution vulnerabilities very hard.

Some browser vendors are also trying to make it harder for attackers to use PDF exploits. Mozilla recently added a built-in, and allegedly more secure, PDF viewer to the beta version of Firefox and expects it to become a stable feature in the next version of the browser, Firefox 19.

Google Chrome has had a built-in PDF viewer since 2010. The component is actually built using Foxit's PDF SDK (software development kit), but is protected by the browser's native sandbox.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Googleadobemozillaonline safetysecuniapatchesExploits / vulnerabilitiesFoxit

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Lucian Constantin

Lucian Constantin

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Ada Chan

Dynabook Portégé X30L-G

I highly recommend the Dynabook Portégé® X30L-G notebook for everyday business use, it is a benchmark setting notebook of its generation in the lightweight category.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?