Bug 102527 (CVE-2005-2471) - VUL-0: CVE-2005-2471: netpbm code execution in pstopnm
Summary: VUL-0: CVE-2005-2471: netpbm code execution in pstopnm
Status: RESOLVED FIXED
Alias: CVE-2005-2471
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other All
: P5 - None : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: CVE-2005-2471: CVSS v2 Base Score: 7....
Keywords:
Depends on:
Blocks:
 
Reported: 2005-08-08 07:50 UTC by Ludwig Nussel
Modified: 2021-11-20 16:25 UTC (History)
1 user (show)

See Also:
Found By: Other
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ludwig Nussel 2005-08-08 07:50:47 UTC
We received the following report via full-disclosure.
The issue is public.

   2 local non-root user
  +1 default package
  +1 default active
  +1 command execution

Total Score: 5 (Moderate)

Date: Fri, 05 Aug 2005 12:44:32 +0200
From: Thierry Carrez <koon@gentoo.org>
To: gentoo-announce@lists.gentoo.org
Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk,
	security-alerts@linuxsecurity.com
Subject: [ GLSA 200508-04 ] Netpbm: Arbitrary code execution in pstopnm

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200508-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Netpbm: Arbitrary code execution in pstopnm
      Date: August 05, 2005
      Bugs: #100398
        ID: 200508-04

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

The pstopnm utility, part of the Netpbm tools, contains a vulnerability
which can potentially result in the execution of arbitrary code.

Background
==========

Netpbm is a package of 220 graphics programs and a programming
libraries, including pstopnm. pstopnm is a tool which converts
PostScript files to PNM image files.

Affected packages
=================

    -------------------------------------------------------------------
     Package            /  Vulnerable  /                    Unaffected
    -------------------------------------------------------------------
  1  media-libs/netpbm       < 10.28                          >= 10.28

Description
===========

Max Vozeler reported that pstopnm calls the GhostScript interpreter on
untrusted PostScript files without specifying the -dSAFER option, to
convert a PostScript file into a PBM, PGM, or PNM file.

Impact
======

An attacker could craft a malicious PostScript file and entice a user
to run pstopnm on it, resulting in the execution of arbitrary commands
with the permissions of the user running pstopnm.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Netpbm users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=media-libs/netpbm-10.28"

References
==========

  [ 1 ] Secunia Advisory SA16184
        http://secunia.com/advisories/16184/

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200508-04.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0
Comment 1 Vladimir Nadvornik 2005-08-09 15:53:17 UTC
fixed packages for 8.2-9.3 and sles8 and sles9 are submitted.
Please submit patchinfo files.
Comment 2 Marcus Meissner 2005-08-11 08:19:35 UTC
CAN-2005-2471 
 
pstopnm in netpbm does not properly use the "-dSAFER" option when calling 
Ghostscript to convert convert a PostScript file into a (1) PBM, (2) PGM, or 
(3) PNM file, which allows external user-complicit attackers to execute 
arbitrary commands. 
 
SWAMPID: 2019 
 
Comment 3 Marcus Meissner 2005-08-11 08:27:22 UTC
patchinfos submitted. 
Comment 4 Marcus Meissner 2005-08-19 14:04:14 UTC
released 
Comment 5 Thomas Biege 2009-10-13 21:36:00 UTC
CVE-2005-2471: CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)