SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Netpbm Vendors:   netpbm.sourceforge.net
(Fedora Issues Fix for RH Linux) Netpbm Uses Unsafe Temporary Files and May Let Local Users Gain Elevated Privileges
SecurityTracker Alert ID:  1011728
SecurityTracker URL:  http://securitytracker.com/id/1011728
CVE Reference:   CVE-2003-0924   (Links to External Site)
Date:  Oct 16 2004
Impact:   Modification of system information, Modification of user information, Root access via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 10.19 and prior versions
Description:   Several vulnerabilities were reported in Netpbm. A local user may be able to obtain elevated privileges on the target system.

It is reported that several components of the netpbm toolkit use temporary files in an unsafe manner. A local user can create a symbolic link from a critical file on the system to a temporary file to be used by the application. Then, when a target user runs the application, the symlinked file may be modified or overwritten with the privileges of the target user.

The 'anytopnm' and 'pnminterp-gen' applications are reportedly affected.

Paul Szabo is credited wtih reporting these flaws.

Impact:   A local user may be able to obtain the privleges of a target user when a target user runs one of the netpbm utilities.
Solution:   Fedora has released a fix.

SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/netpbm-9.24-9.73.4.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-9.24-9.73.4.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-devel-9.24-9.73.4.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-progs-9.24-9.73.4.legacy.i386.rpm


Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/netpbm-9.24-10.90.3.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-9.24-10.90.3.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-devel-9.24-10.90.3.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-progs-9.24-10.90.3.legacy.i386.rpm

The SHA1 verification checksums are:

79c8c3e9e4ef5c60eb0dd243b38775cb24c49e18 7.3/updates/SRPMS/netpbm-9.24-9.73.4.legacy.src.rpm
4a0e11ad855172ce86042d0f85991b6f28f4811b 7.3/updates/i386/netpbm-9.24-9.73.4.legacy.i386.rpm
d69d449139408cf50de7557f38fd9f3a3f86b4c3 7.3/updates/i386/netpbm-devel-9.24-9.73.4.legacy.i386.rpm
173fa566ed92e222581817c4326b3dd501f24313 7.3/updates/i386/netpbm-progs-9.24-9.73.4.legacy.i386.rpm

729fd0be3b7f6ff031436cd8a563edbc57b76ad6 9/updates/SRPMS/netpbm-9.24-10.90.3.legacy.src.rpm
ac5ee4489c0632057ef6d9844ad2c935e5754053 9/updates/i386/netpbm-9.24-10.90.3.legacy.i386.rpm
0d59209ef7e8e4d7630d8f23c372f01adeddeea5 9/updates/i386/netpbm-devel-9.24-10.90.3.legacy.i386.rpm
8076a88d1c299a80db24e7559d0ea6853e6520b9 9/updates/i386/netpbm-progs-9.24-10.90.3.legacy.i386.rpm

Vendor URL:  netpbm.sourceforge.net/ (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  Linux (Red Hat Linux)
Underlying OS Comments:  7.3, 9

Message History:   This archive entry is a follow-up to the message listed below.
Jan 19 2004 Netpbm Uses Unsafe Temporary Files and May Let Local Users Gain Elevated Privileges



 Source Message Contents

Subject:  [Full-Disclosure] [FLSA-2004:1257] Updated netpbm packages fix security vulnerabilities



--+pHx0qQiF2pBVqBT
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

-----------------------------------------------------------------------
               Fedora Legacy Update Advisory

Synopsis:          Updated netpbm resolves security vulnerabilities
Advisory ID:       FLSA:1257
Issue date:        2004-10-08
Product:           Red Hat Linux
Keywords:          Security
Cross references:  https://bugzilla.fedora.us/show_bug.cgi?id=3D1257
CVE Names:         CVE-2003-0924
-----------------------------------------------------------------------


-----------------------------------------------------------------------
1. Topic:

Updated netpbm packages that fix security vulnerabilities are now
available.

The netpbm package contains a library of functions that support
programs for handling various graphics file formats, including .pbm
(portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps),
=2Eppm (portable pixmaps), and others.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386

3. Problem description:

A number of temporary file bugs have been found in versions of NetPBM.
These could make it possible for a local user to overwrite or create files
as a different user who happens to run one of the the vulnerable utilities.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0924 to this issue.

Users are advised to upgrade to the erratum packages, which contain patches
=66rom Debian that correct these bugs.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.

Please note that this update is also available via yum and apt.  Many
people find this an easier way to apply updates.  To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.  This assumes that you have yum or
apt-get configured for obtaining Fedora Legacy content. Please visit
http://www.fedoralegacy.org/docs/ for directions on how to configure yum
and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - 1257 - CAN-2003-0924: Temp file vuln in NetPBM

6. RPMs required:

Red Hat Linux 7.3:

SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/netpbm-9.24-9.73.=
4.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-9.24-9.73.4=
=2Elegacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-devel-9.24-=
9.73.4.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-progs-9.24-=
9.73.4.legacy.i386.rpm


Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/netpbm-9.24-10.90.3=
=2Elegacy.src.rpm

i386:=20
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-9.24-10.90.3.=
legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-devel-9.24-10=
=2E90.3.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-progs-9.24-10=
=2E90.3.legacy.i386.rpm

7. Verification:

SHA1 sum                                 Package Name
---------------------------------------------------------------------------

79c8c3e9e4ef5c60eb0dd243b38775cb24c49e18  7.3/updates/SRPMS/netpbm-9.24-9.7=
3.4.legacy.src.rpm
4a0e11ad855172ce86042d0f85991b6f28f4811b  7.3/updates/i386/netpbm-9.24-9.73=
=2E4.legacy.i386.rpm
d69d449139408cf50de7557f38fd9f3a3f86b4c3  7.3/updates/i386/netpbm-devel-9.2=
4-9.73.4.legacy.i386.rpm
173fa566ed92e222581817c4326b3dd501f24313  7.3/updates/i386/netpbm-progs-9.2=
4-9.73.4.legacy.i386.rpm

729fd0be3b7f6ff031436cd8a563edbc57b76ad6  9/updates/SRPMS/netpbm-9.24-10.90=
=2E3.legacy.src.rpm
ac5ee4489c0632057ef6d9844ad2c935e5754053  9/updates/i386/netpbm-9.24-10.90.=
3.legacy.i386.rpm
0d59209ef7e8e4d7630d8f23c372f01adeddeea5  9/updates/i386/netpbm-devel-9.24-=
10.90.3.legacy.i386.rpm
8076a88d1c299a80db24e7559d0ea6853e6520b9  9/updates/i386/netpbm-progs-9.24-=
10.90.3.legacy.i386.rpm

These packages are GPG signed by Fedora Legacy for security.  Our key is
available from http://www.fedoralegacy org/about/security.php

You can verify each package with the following command:

    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

    sha1sum <filename>

8. References:

http://www.kb.cert.org/vuls/id/487102
https://rhn.redhat.com/errata/RHSA-2004-031.html

9. Contact:

The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
project details at http://www.fedoralegacy.org

---------------------------------------------------------------------

--+pHx0qQiF2pBVqBT
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBZldhYzuFKFF44qURAqkCAKCIS2iSCgvUJRvEYDMrjypNd4/TgACg7VnV
tGcADbAzSRjuJUr7yMVoPdU=
=z8fL
-----END PGP SIGNATURE-----

--+pHx0qQiF2pBVqBT--

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC