Nevis Labs have been credited with discovering critical vulnerability in EDraw PDF viewer.
San Jose, Calif. – June 19, 2009 – Nevis Labs, the vulnerability and threat research arm of Aviram’s Nevis Networks, today announced the latest vulnerability finding related to an insecure method in the EDraw PDF viewer. EDraw PDF Viewer Component is a light weight ActiveX Control, which enables your application to display and interact with PDF files. It is identical to Adobe Reader program and it easily adds high speed viewing of PDF documents to your applications. More information is available at http://www.ocxt.com .
This vulnerability exists due to PDFVIEWER.PDFViewerCtrl.1 ActiveX control (pdfviewer.ocx) providing an insecure “FtpDownloadFile()” method . A remote attacker may exploit this vulnerability by tricking a user into opening a specially-crafted Web page. On successful exploitation, an attacker can remotely execute arbitrary code on affected system. An attacker can download this Trojan into the “startup” folder of the affected system, so that the Trojan will run whenever the computer is restarted.
Nevis Labs have been credited with discovering several critical vulnerabilities in the past, including vulnerabilities with three commercial anti-virus packages, which were presented in last Black Hat Conference. This demonstrates Nevis Labs’ leadership position in this area, as well as the fact that desktop anti-virus systems alone are not enough to thwart today’s sophisticated malware.
“Our world-class threat detection lab maintains vigilant and continuous research for vulnerabilities worldwide,” said Ajit Shelat, CEO/President of Aviram’s Nevis Networks. “Our research and development teams continue to relentlessly address modern day threats with innovative solutions, as part of Nevis LANenforcer family of wire-speed LAN security appliances”. Aviram Networks has recently acquired substantially all Nevis Networks assets in order to lead the market with the Nevis Technology and to provide customers world class security.
About Nevis Labs
Nevis Labs is a worldwide organization that provides round-the-clock monitoring, analysis and solutions for LAN security threats. Nevis Labs’ security experts conduct their own research into vulnerabilities in operating systems, as well as monitor public sources of information on threats. Nevis Labs produces signature updates for Nevis products, and also updates its endpoint verification software to ensure that the latest updates for operating system patches, and antivirus and anti-spyware software are recognized. These updates are provided to Nevis customers on a continuous basis.
About Aviram’s Nevis Networks
Aviram’s Nevis Networks is a market leader in secure switching and identity-based policy enforcement appliances. The company’s LANenforcer product family transparently enforces identity-based policies in real time within the network fabric, tightly controlling who can access a company’s network and what resources they are permitted to use. Cross-industry customers, ranging from financial services, healthcare, education and defense contractors deploy Nevis LANenforcers to protect sensitive network resources and assets, and significantly reduce the overall costs and time to resolve security breaches and conduct network audits. The company is headquartered in San Jose, CA, with R&D centers in Pune, India and Beijing, China.