August 2005
Gentoo - Two Security Advisories
ID: 00687
Ref: 636/05
Date: 16 August 2005:11:46:17
Version: 1
Title: Gentoo - Two Security Advisories
Abstract: 1. AWStats: Arbitrary code execution using malicious Referrer information [GLSA 200508-07], 2. Xpdf, Kpdf, Gpdf: Denial of Service vulnerability [GLSA 200508-08]
Vendors affected: Gentoo
Operating systems affected: Gentoo
Applications affected: Gentoo
Title
=====
Gentoo - Two Security Advisories:
1. AWStats: Arbitrary code execution using malicious Referrer information [GLSA 200508-07]
2. Xpdf, Kpdf, Gpdf: Denial of Service vulnerability [GLSA 200508-08]
Detail
======
Security advisory summaries:
1. AWStats fails to validate certain log input, which could lead to the
execution of arbitrary Perl code during the generation of the
statistics.
2. Xpdf, Kpdf and Gpdf may crash as a result of a Denial of Service
vulnerability.
Security advisory content follows:
1.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200508-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: AWStats: Arbitrary code execution using malicious Referrer
information
Date: August 16, 2005
Bugs: #102145
ID: 200508-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
AWStats fails to validate certain log input, which could lead to the
execution of arbitrary Perl code during the generation of the
statistics.
Background
==========
AWStats is an advanced log file analyzer and statistics generator. In
HTTP reports it parses Referrer information in order to display the
most common Referrer values that caused users to visit the website.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-www/awstats < 6.5 >= 6.5
Description
===========
When using a URLPlugin, AWStats fails to sanitize Referrer URL data
before using them in a Perl eval() routine.
Impact
======
A remote attacker can include arbitrary Referrer information in a HTTP
request to a web server, therefore injecting tainted data in the log
files. When AWStats is run on this log file, this can result in the
execution of arbitrary Perl code with the rights of the user running
AWStats.
Workaround
==========
Disable all URLPlugins in the AWStats configuration.
Resolution
==========
All AWStats users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-www/awstats-6.5"
Note: Users with the vhosts USE flag set should manually use
webapp-config to finalize the update.
References
==========
[ 1 ] CAN-2005-1527
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1527
[ 2 ] iDEFENSE Advisory
http://www.idefense.com/application/poi/display?id=290&type=vulnerabilities
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200508-07.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
2.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200508-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Xpdf, Kpdf, GPdf: Denial of Service vulnerability
Date: August 16, 2005
Bugs: #99769, #100263, #100265
ID: 200508-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Xpdf, Kpdf and GPdf may crash as a result of a Denial of Service
vulnerability.
Background
==========
Xpdf, Kpdf and GPdf are PDF file viewers that run under the X Window
System. Kpdf and GPdf both contain Xpdf code. Kpdf is also part of
kdegraphics.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-text/xpdf < 3.00-r10 >= 3.00-r10
2 kde-base/kdegraphics < 3.3.2-r3 >= 3.3.2-r3
3 kde-base/kpdf < 3.4.1-r1 >= 3.4.1-r1
4 app-text/gpdf < 2.10.0-r1 >= 2.10.0-r1
-------------------------------------------------------------------
4 affected packages on all of their supported architectures.
-------------------------------------------------------------------
Description
===========
Xpdf, Kpdf and GPdf do not handle a broken table of embedded TrueType
fonts correctly. After detecting such a table, Xpdf, Kpdf and GPdf
attempt to reconstruct the information in it by decoding the PDF file,
which causes the generation of a huge temporary file.
Impact
======
A remote attacker may cause a Denial of Service by creating a specially
crafted PDF file, sending it to a CUPS printing system (which uses
Xpdf), or by enticing a user to open it in Xpdf, Kpdf, or GPdf.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Xpdf users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/xpdf-3.00-r10"
All GPdf users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/gpdf-2.10.0-r1"
All Kpdf users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kdegraphics-3.3.2-r3"
All KDE Split Ebuild Kpdf users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kpdf-3.4.1-r1"
References
==========
[ 1 ] CAN-2005-2097
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2097
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200508-08.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0