__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN XPDF/GPDF - CUPS Vulnerabilities [Red Hat Security Advisory RHSA-2005:053-19 (Supercedes CIAC Bulletins P-087, P-088, P-103, and P-104)] February 18, 2005 18:00 GMT Number P-142 [REVISED 22 Feb 2005] [REVISED 04 Mar 2005] [REVISED 11 Mar 2005] [REVISED 16 Mar 2005] [REVISED 31 Mar 2005] [REVISED 01 Apr 2005] ______________________________________________________________________________ PROBLEM: During a source code audit, a number of integer overflow bugs were discovered in Xpdf, GPdf and CUPS. Xpdf and Gpdf have a shared code base and the CUPS printing package contains Xpdf. This bulletin supercedes and consolidates vulnerabilities reported in CIAC P-087, P-088, P-103, and P-104. PLATFORM: Red Hat Desktop (v.3 and 4) Red Hat Enterprise Linux AS, ES, WS (v.3 and 4) & (v. 2.1) Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor SGI Advanced Linux Environment 3 for SGI ProPack 3 Service Pack 4 DAMAGE: CAN-2004-1125 - Addressed in CIAC Bulletins P-087 and P-088. CAN-2004-1267 - A buffer overflow in the ParseCommand function in hpgltops may allow an attacker who has the ability to send a malicious file to a printer to execute code as the 'lp' user. CAN-2004-1268 & CAN-2004-1269 - 'lppasswd utility ignores write errors when modifying the CUPS passwd file. CAN-2004-1270 - The lppasswd utility does not verify the passwd.new file is different from STDERR, and this may allow local users to control output to passwd.new via certain input that triggers an error message. CAN-2005-0064 - Addressed in CIAC Bulletins P-103 and P-104. CAN-2005-0206 - The name CAN-2004-0888 addressed a possible DoS or arbitrary code execution vulnerability; however, it excluded 64-bit architectures. This CAN addresses the 64-bit architectures. SOLUTION: Apply the updated packages. ______________________________________________________________________________ VULNERABILITY The risk is MEDIUM. May allow arbitrary code execution as the ASSESSMENT: user running xpdf, gpdf, or 'lp'. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/p-142.shtml ORIGINAL BULLETIN: https://rhn.redhat.com/errata/RHSA-2005-053.html ADDITIONAL LINKS: Red Hat Security Advisory RHSA-2005:132-09 https://rhn.redhat.com/errata/RHSA-2005-132.html Red Hat Security Advisory RHSA-2005:034-19 https://rhn.redhat.com/errata/RHSA-2005-034.html Red Hat Security Advisory RHSA-2005:057-19 https://rhn.redhat.com/errata/RHSA-2005-057.html Red Hat Security Advisory RHSA-2005:066-12 https://rhn.redhat.com/errata/RHSA-2005-066.html Red Hat Security Advisory RHSA-2005:213-04 https://rhn.redhat.com/errata/RHSA-2005-213.html Red Hat Security Advisory RHSA-2005:026-15 https://rhn.redhat.com/errata/RHSA-2005-026.html SGI Security Advisory 20050204-01-U Security Update #28 http://www.sgi.com/support/security/advisories.html SGI Security Advisory 20050302-01-U Security Update #30 http://www.sgi.com/support/security/advisories.html Red Hat Security Advisory RHSA-2005-354-30 https://rhn.redhat.com/errata/RHSA-2005-354.html CVE/CAN: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CAN-2004-1125 CAN-2004-1267 CAN-2004-1268 CAN-2004-1269 CAN-2004-1270 CAN-2005-0064 CAN-2005-0206 ______________________________________________________________________________ REVISION HISTORY: 02/22/2005 - revised to add links to Red Hat Security Advisories RHSA-2005:034-19, RHSA-2005:057-19, and RHSA-2005:066-12. 03/04/2005 - revised to add a link to Red Hat Security Advisory RHSA-2005:213-04 for Red Hat Enterprise Linux AS. ES, WS (v. 2.1). 03/11/2005 - revised to add a link to SGI Security Advisory 20050204-01-U SGI Advanced Linux Environment 3 Security Update #28 for Patch 10146 for SGI ProPack 3 Service Pack 4. 03/16/2005 - revised to add a link to Red Hat Security Advisory RHSA-2005:026-15 that provides updated packages for Red Hat v. 4 addressing vulnerabilities in CAN-2004-1125 and 2004-0064. 03/31/2005 - revised to add a link to SGI Security Advisory 20050302-01-U SGI Advanced Linux Environment 3 Security Update #30 for Patch 10151 for SGI ProPack 3 Service Pack 4. 04/01/2005 - revised to add a link to Red Hat Security Advisory RHSA-2005:354 that provides updates for vulnerabilities described in CAN-2004-0086, CAN-2004-0088, and CAN-2004-1125. [***** Start Red Hat Security Advisory RHSA-2005:053-19 (Supercedes CIAC Bulletins P-087, P-088, P-103, and P-104) *****] Important: CUPS security update Advisory: RHSA-2005:053-19 Last updated on: 2005-02-15 Affected Products: Red Hat Desktop (v. 4) Red Hat Enterprise Linux AS (v. 4) Red Hat Enterprise Linux ES (v. 4) Red Hat Enterprise Linux WS (v. 4) CVEs (cve.mitre.org): CAN-2004-1125 CAN-2004-1267 CAN-2004-1268 CAN-2004-1269 CAN-2004-1270 CAN-2005-0064 CAN-2005-0206 back Security Advisory Security Advisory Details: Updated CUPS packages that fix several security issues are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIX Printing System provides a portable printing layer for UNIX(R) operating systems. During a source code audit, Chris Evans and others discovered a number of integer overflow bugs that affected all versions of Xpdf, which also affects CUPS due to a shared codebase. An attacker could construct a carefully crafted PDF file that could cause CUPS to crash or possibly execute arbitrary code when opened. This issue was assigned the name CAN-2004-0888 by The Common Vulnerabilities and Exposures project (cve.mitre.org). Red Hat Enterprise Linux 4 contained a fix for this issue, but it was found to be incomplete and left 64-bit architectures vulnerable. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0206 to this issue. A buffer overflow flaw was found in the Gfx::doImage function of Xpdf which also affects the CUPS pdftops filter due to a shared codebase. An attacker who has the ability to send a malicious PDF file to a printer could possibly execute arbitrary code as the "lp" user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1125 to this issue. A buffer overflow flaw was found in the ParseCommand function in the hpgltops program. An attacker who has the ability to send a malicious HPGL file to a printer could possibly execute arbitrary code as the "lp" user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1267 to this issue. A buffer overflow flaw was found in the Decrypt::makeFileKey2 function of Xpdf which also affects the CUPS pdftops filter due to a shared codebase. An attacker who has the ability to send a malicious PDF file to a printer could possibly execute arbitrary code as the "lp" user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue. The lppasswd utility was found to ignore write errors when modifying the CUPS passwd file. A local user who is able to fill the associated file system could corrupt the CUPS password file or prevent future uses of lppasswd. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-1268 and CAN-2004-1269 to these issues. The lppasswd utility was found to not verify that the passwd.new file is different from STDERR, which could allow local users to control output to passwd.new via certain user input that triggers an error message. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1270 to this issue. All users of cups should upgrade to these updated packages, which contain backported patches to resolve these issues. Updated packages: Red Hat Desktop (v. 4) SRPMS: cups-1.1.22-0.rc1.9.6.src.rpm 5b34a0b5b4b92c00c2749e69677812ce IA-32: cups-1.1.22-0.rc1.9.6.i386.rpm f03c9683b85077d490b9a5d1a12dbf02 cups-devel-1.1.22-0.rc1.9.6.i386.rpm 2c494e4a5db28b42289eff83235067d1 cups-libs-1.1.22-0.rc1.9.6.i386.rpm 881ce46b1a0828bf88560372b9900d56 x86_64: cups-1.1.22-0.rc1.9.6.x86_64.rpm 1bc2ddfe634054bfad3b7f1cf77aedb4 cups-devel-1.1.22-0.rc1.9.6.x86_64.rpm 243af656ba1608d1e333e58b39596e81 cups-libs-1.1.22-0.rc1.9.6.i386.rpm 881ce46b1a0828bf88560372b9900d56 cups-libs-1.1.22-0.rc1.9.6.x86_64.rpm c3a609ed5adb389aeb835a83c251f14a Red Hat Enterprise Linux AS (v. 4) SRPMS: cups-1.1.22-0.rc1.9.6.src.rpm 5b34a0b5b4b92c00c2749e69677812ce IA-32: cups-1.1.22-0.rc1.9.6.i386.rpm f03c9683b85077d490b9a5d1a12dbf02 cups-devel-1.1.22-0.rc1.9.6.i386.rpm 2c494e4a5db28b42289eff83235067d1 cups-libs-1.1.22-0.rc1.9.6.i386.rpm 881ce46b1a0828bf88560372b9900d56 IA-64: cups-1.1.22-0.rc1.9.6.ia64.rpm b29b182820006775fc18004fdbb43afc cups-devel-1.1.22-0.rc1.9.6.ia64.rpm 3611e17b23990951b1d61747dfe195d9 cups-libs-1.1.22-0.rc1.9.6.i386.rpm 881ce46b1a0828bf88560372b9900d56 cups-libs-1.1.22-0.rc1.9.6.ia64.rpm ca8aef782179f2027ffacc8e8309594b PPC: cups-1.1.22-0.rc1.9.6.ppc.rpm 5c208f69a019f0f2f96b851af386fc6c cups-devel-1.1.22-0.rc1.9.6.ppc.rpm 30ad7d6e59830a0ea9c488265b605eee cups-libs-1.1.22-0.rc1.9.6.ppc.rpm 9fb369e243e1a43806727d97b98733af cups-libs-1.1.22-0.rc1.9.6.ppc64.rpm b0044742ecf8db6d67e8f91a94d445bf s390: cups-1.1.22-0.rc1.9.6.s390.rpm bc9eda3c1e297990bcde213b15a075f2 cups-devel-1.1.22-0.rc1.9.6.s390.rpm c31831240bcabef05ac45010a1bc72a1 cups-libs-1.1.22-0.rc1.9.6.s390.rpm 4987b5dfdb7a550d8a706da6ad6667f0 s390x: cups-1.1.22-0.rc1.9.6.s390x.rpm 95afc86836c586a381c6036ad040f12e cups-devel-1.1.22-0.rc1.9.6.s390x.rpm 5d99e8d249a023ed7d0563b0dd7f53ad cups-libs-1.1.22-0.rc1.9.6.s390.rpm 4987b5dfdb7a550d8a706da6ad6667f0 cups-libs-1.1.22-0.rc1.9.6.s390x.rpm 3306eafd9bc433d027f6630fa7cb5613 x86_64: cups-1.1.22-0.rc1.9.6.x86_64.rpm 1bc2ddfe634054bfad3b7f1cf77aedb4 cups-devel-1.1.22-0.rc1.9.6.x86_64.rpm 243af656ba1608d1e333e58b39596e81 cups-libs-1.1.22-0.rc1.9.6.i386.rpm 881ce46b1a0828bf88560372b9900d56 cups-libs-1.1.22-0.rc1.9.6.x86_64.rpm c3a609ed5adb389aeb835a83c251f14a Red Hat Enterprise Linux ES (v. 4) SRPMS: cups-1.1.22-0.rc1.9.6.src.rpm 5b34a0b5b4b92c00c2749e69677812ce IA-32: cups-1.1.22-0.rc1.9.6.i386.rpm f03c9683b85077d490b9a5d1a12dbf02 cups-devel-1.1.22-0.rc1.9.6.i386.rpm 2c494e4a5db28b42289eff83235067d1 cups-libs-1.1.22-0.rc1.9.6.i386.rpm 881ce46b1a0828bf88560372b9900d56 IA-64: cups-1.1.22-0.rc1.9.6.ia64.rpm b29b182820006775fc18004fdbb43afc cups-devel-1.1.22-0.rc1.9.6.ia64.rpm 3611e17b23990951b1d61747dfe195d9 cups-libs-1.1.22-0.rc1.9.6.i386.rpm 881ce46b1a0828bf88560372b9900d56 cups-libs-1.1.22-0.rc1.9.6.ia64.rpm ca8aef782179f2027ffacc8e8309594b x86_64: cups-1.1.22-0.rc1.9.6.x86_64.rpm 1bc2ddfe634054bfad3b7f1cf77aedb4 cups-devel-1.1.22-0.rc1.9.6.x86_64.rpm 243af656ba1608d1e333e58b39596e81 cups-libs-1.1.22-0.rc1.9.6.i386.rpm 881ce46b1a0828bf88560372b9900d56 cups-libs-1.1.22-0.rc1.9.6.x86_64.rpm c3a609ed5adb389aeb835a83c251f14a Red Hat Enterprise Linux WS (v. 4) SRPMS: cups-1.1.22-0.rc1.9.6.src.rpm 5b34a0b5b4b92c00c2749e69677812ce IA-32: cups-1.1.22-0.rc1.9.6.i386.rpm f03c9683b85077d490b9a5d1a12dbf02 cups-devel-1.1.22-0.rc1.9.6.i386.rpm 2c494e4a5db28b42289eff83235067d1 cups-libs-1.1.22-0.rc1.9.6.i386.rpm 881ce46b1a0828bf88560372b9900d56 IA-64: cups-1.1.22-0.rc1.9.6.ia64.rpm b29b182820006775fc18004fdbb43afc cups-devel-1.1.22-0.rc1.9.6.ia64.rpm 3611e17b23990951b1d61747dfe195d9 cups-libs-1.1.22-0.rc1.9.6.i386.rpm 881ce46b1a0828bf88560372b9900d56 cups-libs-1.1.22-0.rc1.9.6.ia64.rpm ca8aef782179f2027ffacc8e8309594b x86_64: cups-1.1.22-0.rc1.9.6.x86_64.rpm 1bc2ddfe634054bfad3b7f1cf77aedb4 cups-devel-1.1.22-0.rc1.9.6.x86_64.rpm 243af656ba1608d1e333e58b39596e81 cups-libs-1.1.22-0.rc1.9.6.i386.rpm 881ce46b1a0828bf88560372b9900d56 cups-libs-1.1.22-0.rc1.9.6.x86_64.rpm c3a609ed5adb389aeb835a83c251f14a (The unlinked packages above are only available from the Red Hat Network) Solution Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ Bugs fixed: (see bugzilla for more information) 144191 - CAN-2004-1267 Bernstein cups issues (CAN-2004-1268 CAN-2004-1269 CAN-2004-1270) 144194 - CAN-2004-1125 xpdf buffer overflow 145088 - CAN-2005-0064 xpdf buffer overflow 147480 - CAN-2004-0888 xpdf issues affect cups (CAN-2005-0206) References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1267 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1268 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1269 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1270 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0064 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0206 These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from: https://www.redhat.com/security/team/key/#package The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/ [***** End Red Hat Security Advisory RHSA-2005:053-19 (Supercedes CIAC Bulletins P-087, P-088, P-103, and P-104) *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Red Hat for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) P-132: Microsoft Vulnerability in the License Logging Service P-133: Symantec UPX Parsing Engine Vulnerability P-134: Microsoft Vulnerability in Windows SharePoint Services and SharePoint Team Services P-135: HP-UX ftpd Remote Privileged Access P-136: Microsoft PNG Processing Vulnerability P-137: Mailman Vulnerabilities P-138: Updated Squid Package Fixes Security Issues P-139: PostgreSQL Vulnerabilities P-140: AWStats Vulnerabilities P-141: HP Web-enabled Management Software Vulnerability