Heap Buffer Overflow in SumatraPDF Reader

Executive Summary

This is a heap out-of-bounds read vulnerability in SumatraPDF's MOBI header parser. The issue occurs because the MobiDoc::ParseHeader function validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass checks and cause the decoder to read beyond a short heap buffer, leading to a crash.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for crashes when opening MOBI files in SumatraPDF versions prior to 3.6. Monitor SumatraPDF logs or system crash reports for heap out-of-bounds read errors during MOBI file processing.

Useful 0 Not Useful 0

Impact Analysis

Opening a crafted MOBI file can crash SumatraPDF. The vulnerability allows an attacker to cause a heap out-of-bounds read by setting the hdrLen field to 232, forcing the decoder to read up to 232 bytes from a buffer as small as 132 bytes. This can lead to application instability or denial of service without requiring additional user interaction beyond opening the file.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a heap out-of-bounds read in SumatraPDF's MOBI file parser that could allow an attacker to crash the application by opening a malicious file. While it does not directly expose or leak data, crashes in document processing software could potentially disrupt access to sensitive documents, which may impact compliance with standards like GDPR or HIPAA that require availability and integrity of data processing systems.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SumatraPDF to version 3.6 or later to apply the fix. Avoid opening untrusted MOBI files until the update is installed. If immediate upgrade is not possible, disable MOBI file support in SumatraPDF or use an alternative PDF reader.

Useful 0 Not Useful 0