Bug 102527 (CVE-2005-2471)

Summary:	VUL-0: CVE-2005-2471: netpbm code execution in pstopnm
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Ludwig Nussel <lnussel>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P5 - None	CC:	security-team
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	All
Whiteboard:	CVE-2005-2471: CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Found By:	Other	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Ludwig Nussel 2005-08-08 07:50:47 UTC

We received the following report via full-disclosure.
The issue is public.

   2 local non-root user
  +1 default package
  +1 default active
  +1 command execution

Total Score: 5 (Moderate)

Date: Fri, 05 Aug 2005 12:44:32 +0200
From: Thierry Carrez <koon@gentoo.org>
To: gentoo-announce@lists.gentoo.org
Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk,
	security-alerts@linuxsecurity.com
Subject: [ GLSA 200508-04 ] Netpbm: Arbitrary code execution in pstopnm

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200508-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Netpbm: Arbitrary code execution in pstopnm
      Date: August 05, 2005
      Bugs: #100398
        ID: 200508-04

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

The pstopnm utility, part of the Netpbm tools, contains a vulnerability
which can potentially result in the execution of arbitrary code.

Background
==========

Netpbm is a package of 220 graphics programs and a programming
libraries, including pstopnm. pstopnm is a tool which converts
PostScript files to PNM image files.

Affected packages
=================

    -------------------------------------------------------------------
     Package            /  Vulnerable  /                    Unaffected
    -------------------------------------------------------------------
  1  media-libs/netpbm       < 10.28                          >= 10.28

Description
===========

Max Vozeler reported that pstopnm calls the GhostScript interpreter on
untrusted PostScript files without specifying the -dSAFER option, to
convert a PostScript file into a PBM, PGM, or PNM file.

Impact
======

An attacker could craft a malicious PostScript file and entice a user
to run pstopnm on it, resulting in the execution of arbitrary commands
with the permissions of the user running pstopnm.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Netpbm users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=media-libs/netpbm-10.28"

References
==========

  [ 1 ] Secunia Advisory SA16184
        http://secunia.com/advisories/16184/

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200508-04.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

Comment 1 Vladimir Nadvornik 2005-08-09 15:53:17 UTC

fixed packages for 8.2-9.3 and sles8 and sles9 are submitted.
Please submit patchinfo files.

Comment 2 Marcus Meissner 2005-08-11 08:19:35 UTC

CAN-2005-2471 
 
pstopnm in netpbm does not properly use the "-dSAFER" option when calling 
Ghostscript to convert convert a PostScript file into a (1) PBM, (2) PGM, or 
(3) PNM file, which allows external user-complicit attackers to execute 
arbitrary commands. 
 
SWAMPID: 2019

Comment 3 Marcus Meissner 2005-08-11 08:27:22 UTC

patchinfos submitted.

Comment 4 Marcus Meissner 2005-08-19 14:04:14 UTC

released

Comment 5 Thomas Biege 2009-10-13 21:36:00 UTC

CVE-2005-2471: CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)