CVE-2020-6115

An exploitable vulnerability exists in the cross-reference table repairing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242. While searching for an object identifier in a malformed document that is missing from the cross-reference table, the application will save a reference to the object’s cross-reference table entry inside a stack variable. If the referenced object identifier is not found, the application may resize the cross-reference table which can change the scope of its entry. Later when the application tries to reference cross-reference entry via the stack variable, the application will access memory belonging to the recently freed table causing a use-after-free condition. A specially crafted document can be delivered by an attacker and loaded by a victim in order to trigger this vulnerability.

CVSS v3 7.8 HIGH
CVSS v2.0 6.8 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1068	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gonitro:nitro_pro:13.13.2.242:::::::*
	cpe:2.3:a:gonitro:nitro_pro:13.16.2.300:::::::*

History

No history.

Information

Published : 2020-09-17 13:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-6115

Mitre link : CVE-2020-6115

CVE.ORG link : CVE-2020-6115

JSON object : View

Products Affected

gonitro

nitro_pro

CWE

CWE-416

Use After Free

{"id": "CVE-2020-6115", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-09-17T13:15:16.197", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1068", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}, {"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "An exploitable vulnerability exists in the cross-reference table repairing functionality of Nitro Software, Inc.\u2019s Nitro Pro 13.13.2.242. While searching for an object identifier in a malformed document that is missing from the cross-reference table, the application will save a reference to the object\u2019s cross-reference table entry inside a stack variable. If the referenced object identifier is not found, the application may resize the cross-reference table which can change the scope of its entry. Later when the application tries to reference cross-reference entry via the stack variable, the application will access memory belonging to the recently freed table causing a use-after-free condition. A specially crafted document can be delivered by an attacker and loaded by a victim in order to trigger this vulnerability."}, {"lang": "es", "value": "Se presenta una vulnerabilidad explotable en la funcionalidad cross-reference table repairing de Nitro Pro de Nitro Software, Inc versi\u00f3n 13.13.2.242. Mientras busca un identificador de objeto en un documento malformado que se encuentra en la tabla de referencias cruzadas, la aplicaci\u00f3n guardar\u00e1 una referencia a la entrada de la tabla de referencias cruzadas del objeto dentro de una variable de pila. Si no se encuentra el identificador del objeto al que se hace referencia, la aplicaci\u00f3n puede cambiar el tama\u00f1o de la tabla de referencias cruzadas, lo que puede cambiar el alcance de su entrada. M\u00e1s tarde, cuando la aplicaci\u00f3n intenta hacer referencia a una entrada de referencia cruzada por medio de la variable de pila, la aplicaci\u00f3n acceder\u00e1 a la memoria que pertenece a la tabla liberada recientemente, causando una condici\u00f3n de uso de la memoria previamente liberada. Un atacante puede entregar un documento especialmente dise\u00f1ado y cargado por una v\u00edctima para desencadenar esta vulnerabilidad"}], "lastModified": "2022-05-12T17:25:04.017", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gonitro:nitro_pro:13.13.2.242:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0B9A6A1-1800-405F-8435-15AFD4FD1801"}, {"criteria": "cpe:2.3:a:gonitro:nitro_pro:13.16.2.300:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1C5AA0C-F33F-4260-8CCC-82D896186225"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}