Multiple Remote Code Execution Bugs in NitroPDF

[upnorth]

Content source

https://blog.talosintelligence.com/2019/10/vuln-spotlight-Nitro-PDF-RCE-bugs-sept-19.html

Cisco Talos recently discovered multiple remote code execution vulnerabilities in NitroPDF. Nitro PDF allows users to save, read, sign and edit PDF files on their machines. There are two versions of the product: a free and a paid version called “Pro.” The paid version offers several features the free one does not, including the ability to combine multiple PDFs into one file and to redact sensitive information in the file. These bugs all exist in the Pro version of the software.

 

[Freki123]

Quote: "These bugs all exist in the Pro version of the software".
So if you use the "free" version you are not affected? Atleast thats how I understand it....

 

[Venustus]

Quote: "These bugs all exist in the Pro version of the software".
So if you use the "free" version you are not affected? Atleast thats how I understand it....

Ironically, the answer is yes.

 

[Freki123]

Thanks for the clarification

 

[LASER_oneXM]

Nitro PDF Pro to Get Micropatches for 7 Potential RCE Bugs
source: Nitro PDF Pro to Get Micropatches for 7 Potential RCE Bugs

The current version of Nitro PDF Pro has at least one vulnerability that could be used to attempt remote code execution on the victim host. A fix from a third party is on its way.

An official patch from the developer is unavailable for this security flaw, which has a severity score of 8.8 out of 10. Leveraging is possible through a specially crafted PDF file opened with a vulnerable version of the software.

Nitro PDF's developer has a customer base predominantly from the enterprise world. Companies operating at a national or global scale are on the list, running its software as an alternative to Adobe Acrobat Pro.

Its customers include the Australian Pacific National rail freight operator, German automotive manufacturer Continental, Zebra Technologies (asset tracking solutions), T-Mobile Austria (telecom), Swiss Re (insurance), and JLL (property management).

 

[dinosaur07]

This software is way too expensive for the Pro version. Pdf solutions tend to be cheaper lately.

 

[Dhruv2193]

This software is way too expensive for the Pro version. Pdf solutions tend to be cheaper lately.

I think it is so because once a software becomes No.1 Competitor to top product adobe, the company increases the prices to expand etc.