|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2004-0631: buffer overflow and shell meta character problem in acroread | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Johannes Meixner <jsmeix> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | VERIFIED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Major | ||
| Priority: | P3 - Medium | CC: | burnus, forgotten_OS1JNCFbCX, jsmeix, security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | CVE-2004-0631: CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Bug Depends on: | 57092 | ||
| Bug Blocks: | |||
| Attachments: |
patchinfo for box
patchinfo for maintained |
||
|
Description
Forgotten User OS1JNCFbCX
2004-08-13 17:15:28 UTC
this is CAN-2004-0630 and CAN-2004-0631. The advisories state that 'the vendor appears to have silently fixed this vulnerability' and that 5.09 is not affected. We have 5.08 on most releases. Johannes do you know whether adobe has patched 5.08 already? I have no information from Adobe. I will not touch any acroread package until bug 57092 is not solved. *** Bug 58851 has been marked as a duplicate of this bug. *** I want to mark that one can find at http://www.adobe.com/products/acrobat/readstep2.html the version 5.0.9. HEAD /pub/adobe/acrobatreader/unix/5.x/linux-509.tar.gz HTTP/1.1 Host: ardownload.adobe.com Last-Modified: Tue, 25 May 2004 00:13:30 GMT And in the advisitories, I find: "iDEFENSE has tested Adobe Acrobat Reader (UNIX) 5.0.9, which appears to be patched against this vulnerability." We know about the newest version. We know where to get it. We know what iDEFENSE wrote. Nevertheless: Read my comment #2. Johannes wants to say that we will need to clarify the license issues before doing any further updates. Johannes, I think the problem here was, that external people are not allowed to read bug 57092. Ah, yes, thanks to explain it! <!-- SBZ_reopen -->Reopened by jsmeix@suse.de at Tue Aug 17 11:07:25 2004, took initial reporter rschiele@uni-mannheim.de to cc Especially for acroread version 5.09 the license problem is solved, see http://bugzilla.suse.de/show_bug.cgi?id=42092#c19 Therefore I will now make security updates to version 5.09 Submitted acroread version 5.09 package to /work/src/done/ 8.1/acroread = SLES8/acroread = UL1/acroread 8.2/acroread 9.0/acroread 9.1/acroread = SLES9/acroread For me it is fixed. I reassign it to the security-team. I submitted the patchinfo files. Will append them here for completeness. Created attachment 22752 [details]
patchinfo for box
...
Created attachment 22753 [details]
patchinfo for maintained
...
According to
/work/src/done/PATCHINFO/acroread.patch.maintained
---------------------------------------------------------------------------
DISTRIBUTION: sles7-i386,sles8-slec-i386,sles9-i386,sles9-x86_64,ul1-i386
---------------------------------------------------------------------------
the security update should be made for SLES7 too
and according to "is_maintained acroread"
---------------------------------------------------------------------------
Package is on CD slos-1.0.i386
Distribution: sles7-i386
Distributionstring: SuSE-Linux-SLOS-i386
Marketing-Name: SuSE Linux Office Server
---------------------------------------------------------------------------
it is really maintained for SLES7 but there is no directory for SLES7
under /work/src/done/
Therefore I don't know what to do regarding SLES7.
I think SLES7 isnt supported anymore no? So I will remove the sles7 entry from patchinfo. yes, please remove it. updates approved. CVE-2004-0631: CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) |