MuPDF < 20091125231942 - 'pdf_shade4.c' Multiple Stack Buffer Overflows

ExploitDBExploitDB exploitWriteupEDB-10244

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing multiple stack-based buffer overflows in MuPDF's pdf_shade4.c. It includes a timeline, vulnerable code snippet, exploitation notes, and a Ruby script that creates a PDF with an oversized /Decode array to trigger a crash. The script is explicitly labeled 'crash only' and the author states that modification for successful exploitation is left as an exercise.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a vulnerability disclosure and proof-of-concept (PoC) script for CVE-2009-4117, a stack buffer overflow in MuPDF/SumatraPDF. It describes the vulnerability, provides a Ruby script to generate a malicious PDF that triggers a crash, and discusses exploitation techniques. No backdoor, trojan, or deceptive payload targeting the person running the PoC is present. The script's purpose is to create a PDF that exploits the target application, which is normal exploit behavior.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
Languagesrubyenglish
Target softwareMuPDFSumatraPDF
Attack typesstack-based buffer overflow
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is primarily a technical analysis and description of the vulnerability, including a timeline, code snippet, and exploitation theory. The included Ruby script is explicitly described as 'crash only' PoC code and does not contain shellcode or exploit payload; the author states that modification for successful exploitation is left as an exercise. Therefore, the artifact is a writeup, not an exploit or scanner.

exploits/windows/local/10244.txt:64exploits/windows/local/10244.txt:86-87

Requirements

  • Target must be running a vulnerable version of MuPDF or SumatraPDF (before commit 20091125231942 or version 1.0.1 respectively).exploits/windows/local/10244.txt:5-8
  • The Origami PDF framework Ruby library must be available to run the provided script.exploits/windows/local/10244.txt:60-61

Observed behavior

  • The Ruby script generates a PDF file named 'toto.pdf' containing a shading object with an oversized /Decode array designed to overflow stack buffers c0 and c1 in the vulnerable functions.exploits/windows/local/10244.txt:64-83
  • The generated PDF is intended to cause a crash (denial of service) when opened with a vulnerable version of SumatraPDF.exploits/windows/local/10244.txt:64
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
Stack-based buffer overflow in pdf_shade4.c via /Decode arrayThe text describes CVE-2009-4117 and provides a PoC script to trigger the vulnerability.exploits/windows/local/10244.txt:5-7
Poc Script
Ruby script using Origami PDF framework to create a PDF with an oversized /Decode arrayThe script generates a PDF file (toto.pdf) that triggers the buffer overflow when opened in a vulnerable version of SumatraPDF.exploits/windows/local/10244.txt:64-83
Exploitation Notes
Discussion of exploitation tricks (avoiding overwrite of obj pointer, floating-point encoding of shellcode, avoiding NaN values)The author provides guidance on how to modify the PoC for code execution, which is typical for exploit documentation.exploits/windows/local/10244.txt:40-58
Review boundaries

What the analysis did not establish

  • The artifact references an external Metasploit-generated shellcode and a jmp esp gadget in a specific SumatraPDF binary, but these are not included in the evidence.
  • The Ruby script requires the external Origami PDF framework library, which is not provided.
  • The review is limited to the supplied text file; no external resources, binaries, or the generated PDF were inspected.
  • The PoC script is not executed, so its runtime behavior is not verified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1