Nitro Pro 10.5.7.32 Nitro Reader 5.5.3.1 - Heap Memory Corruption

#####################################################################################

Application: Nitro PDF

Platforms: Windows

Versions: Nitro Pro 10.5.7.32 and lower  & Nitro Reader 5.5.3.1 and lower

Author: Francis Provencher of COSIG

Website: http://www.protekresearchlab.com/

Twitter: @COSIG_ @protekresearch

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Nitro develops commercial software used to create, edit, sign, and secure Portable Document Format (PDF) files and digital documents. The Nitro ecosystem consists of Nitro Pro, Nitro Cloud, Nitro Reader, and a suite of document conversion sites.

Nitro’s product family is intended for the professional market and although its desktop products are Windows-only, Nitro Cloud is compatible with any web browser on any machine. The Nitro PDF Reader is freeware for both personal and professional use.

(https://en.wikipedia.org/wiki/Nitro_PDF)

#####################################################################################

============================
2) Report Timeline
============================

2015-12-29: Francis Provencher from COSIG report issue to GoNitro sales team;
2016-01-02: GoNitro confirmed this issue;
2016-01-21: GoNitro fixed this issue;

https://www.gonitro.com/support/security-update
#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Nitro PDF 10 (10.5.7.32).
User interaction is required to exploit this vulnerability in that the target must open a malicious file.

A specially crafted PDF with a specific FunctionType 0 and an invalid /Domain can force an heap memory corruption

by pointing to an uninitialized space of memory.An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process.1

.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2016-13.pdf
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39546.zip

###############################################################################