CVE-2019-25549

Executive Summary

CVE-2019-25549 is a denial of service (DoS) vulnerability in VeryPDF PCL Converter version 2.7. The flaw resides in the PDF Security encryption fields, where a local attacker can supply an excessively long password string (3000 bytes) to trigger a buffer overflow. This causes the application to crash when processing PCL files, leading to a denial of service. The vulnerability has a CVSS score of 6.2 (Medium) and is currently unpatched. No public exploit code or Nuclei template is available, but the proof of concept is straightforward.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone desktop application (VeryPDF PCL Converter) distributed via the vendor's website. Users should verify the integrity of downloaded binaries using checksums provided by the vendor, if available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.2 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open a crafted file or interact with the application.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Application crash leads to denial of service.

Threat Level: Medium. Exploitation requires local access and user interaction, but the impact is limited to availability.

Deep Dive & Mechanics

The vulnerability exists in the PDF Security encryption fields of VeryPDF PCL Converter 2.7. When a user opens a PCL file and enters a password in the PDF Security dialog, the application copies the password into a fixed-size buffer without proper bounds checking. By supplying a password string of 3000 bytes (or more), the attacker overflows the buffer, corrupting adjacent memory and causing the application to crash.

Root Cause: The application uses a strcpy or similar unsafe function to copy the password into a stack-based buffer of insufficient size (likely 256 bytes or less). No validation of input length is performed before the copy.

Attack Flow:

1. Attacker crafts a PCL file (or uses any file that triggers the PDF Security dialog).
2. Attacker opens the file in VeryPDF PCL Converter.
3. In the PDF Security dialog, the attacker enters a password of 3000 bytes.
4. The application copies the password into a fixed buffer, causing a buffer overflow.
5. The overflow corrupts the stack, leading to a crash (denial of service).

Potential for Code Execution: While the original description only mentions denial of service, buffer overflows in stack buffers can sometimes be exploited for arbitrary code execution if the attacker can control the overflow data and bypass modern mitigations (ASLR, DEP). However, no public exploit demonstrates code execution.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code pattern to a secure implementation.

Vulnerable Code (C/C++ example):

void SetPassword(char *userInput) {
    char buffer[256];
    strcpy(buffer, userInput); // Unsafe: no bounds checking
    // ... use buffer
}

Patched Code (Secure implementation):

void SetPassword(char *userInput) {
    char buffer[256];
    strncpy(buffer, userInput, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0'; // Ensure null termination
    // ... use buffer
}

The patched version uses strncpy with a size limit and ensures null termination, preventing buffer overflow.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• VeryPDF PCL Converter 2.7 installed on a Windows system.
• A PCL file (any valid file will do, as the vulnerability is triggered via the UI).

Proof of Concept (PoC):

1. Open VeryPDF PCL Converter.
2. Load any PCL file (e.g., test.pcl).
3. Go to File -> PDF Security.
4. In the password field, enter a string of 3000 'A' characters.
5. Click OK. The application will crash immediately.

Automated PoC (Python script to generate the password):

# generate_password.py
password = "A" * 3000
with open("password.txt", "w") as f:
    f.write(password)
print("Password file generated. Copy the content into the PDF Security password field.")

Note: No public exploit code (e.g., from Exploit-DB) is available. The above is a manual PoC.

Blue Team (Detection & Prevention)

Detection:

• Monitor for crashes of pclconverter.exe or similar processes.
• Use Sysmon to log process termination events (Event ID 4689) with exit codes indicating crashes (e.g., 0xc0000005 for access violation).
• Enable application crash dumps for analysis.

Prevention:

• Apply input validation at the application level (not possible without vendor patch).
• Use application whitelisting to block untrusted executables.
• Run the application in a sandbox or with reduced privileges.
• Consider using a different PDF conversion tool that is actively maintained.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hash depends on the specific version)
  • pclconverter.exe: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Name: pclconverter.exe
• Event Logs:
  • Windows Application Event Log: Event ID 1000 (Application Error) with faulting module pclconverter.exe.
  • Sysmon Event ID 4689 (Process Terminated) with exit code 0xc0000005.
• Network Indicators: None (local vulnerability).
• Registry Keys: None.

Detection Engineering

YARA Rule

rule CVE_2019_25549_VeryPDF_PCL_Converter_Crash {
    meta:
        description = "Detects crash artifacts from CVE-2019-25549 buffer overflow in VeryPDF PCL Converter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2019-25549"
    strings:
        $crash_log = "pclconverter.exe" nocase
        $exception_code = "0xc0000005" nocase
        $fault_module = "pclconverter.exe" nocase
    condition:
        $crash_log and ($exception_code or $fault_module)
}

Sigma Rule

title: VeryPDF PCL Converter Crash Due to Buffer Overflow
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects application crashes of VeryPDF PCL Converter caused by CVE-2019-25549 buffer overflow.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-25549
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        ApplicationName: 'pclconverter.exe'
        FaultingModuleName: 'pclconverter.exe'
    condition: selection
falsepositives:
    - Legitimate crashes due to other reasons
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2019-25549 VeryPDF PCL Converter Buffer Overflow Attempt"; flow:to_server; content:"|41 41 41 41|"; depth:3000; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-dos; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder for network-based detection. Since the vulnerability is local, network detection is not applicable. The rule above would only trigger if the password is sent over the network (unlikely).

Remediation & Mitigation

Immediate Actions:

1. No Patch Available: Since the vendor has not released a patch, the only mitigation is to avoid using VeryPDF PCL Converter 2.7 for untrusted files.
2. User Awareness: Train users not to open PCL files from untrusted sources and to avoid entering excessively long passwords in the PDF Security dialog.
3. Application Sandboxing: Run the application in a sandbox or virtual machine to limit the impact of a crash.

Long-Term Solutions:

1. Vendor Update: Monitor the vendor's website for a patched version. If none is released, consider migrating to an alternative PDF conversion tool.
2. Code Audit: If you have access to the source code, implement input validation and use safe string functions (e.g., strncpy instead of strcpy).
3. Compensating Controls: Use host-based intrusion detection systems (HIDS) to monitor for crashes and alert security teams.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.