What is the risk of a PDF "infected" with BC.Pdf.Exploit.CVE_2017_3033?

Question

ClamAV (detection version 20170623) detects BC.Pdf.Exploit.CVE_2017_3033 in quite some PDF files. I wonder if this is not a false-positive because no other engines detect such "infection". The CVE regards:

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have a memory address leak vulnerability when handling JPEG 2000 code-stream tile data.

• CVSS v2 Base Score: 4.3 MEDIUM
• CVSS v3 Base Score: 3.3 LOW

Source: https://nvd.nist.gov/vuln/detail/CVE-2017-3033

Does this mean that the PDF file is just causing Adobe Acrobat Reader to crash due to memory address leak? Or does this mean that the PDF is "infected" and can it cause more harm? Or is it just that the JPEG 2000 code-stream in that PDF file can possibly cause Adobe Reader to crash?

Lastly, apart from obviously updating Adobe Reader, what can I do in order to "fix" and "clean" this PDF files?

Answer 1

Determining if this is a false positive or not is impossible without actually looking at the files.

The vulnerability in question seems to be a classical out of bounds read and probably exploitable but it's hard to tell until somebody actually puts in the work to write an exploit.

Maybe you should consider telling the ClamAV people to look into this. A similar problem has apparently already been fixed: https://lists.gt.net/clamav/users/69581

Answer 2

I just experienced this same issue. ClamXav found 10+ PDFs on my Mac with BC.Pdf.Exploit.CVE_2017_3033 infections. I opened each PDF in Adobe Acrobat Pro 11.0.13, did a Save As…, chose a similar name, and scanned the new files again. ClamXav declared the new PDFs to be clean.

All of the PDFs were downloaded from Google Books during a similar timeframe. That is all I can contribute.