SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   a2ps Vendors:   GNU [multiple authors]
(Gentoo Issues Fix) a2ps Executes Shell Commands Contained Within Filenames
SecurityTracker Alert ID:  1012783
SecurityTracker URL:  http://securitytracker.com/id/1012783
CVE Reference:   CVE-2004-1170   (Links to External Site)
Date:  Jan 6 2005
Impact:   Execution of arbitrary code via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.13
Description:   A vulnerability was reported in a2ps. A user can execute arbitrary shell commands on the target system.

In August 2004, Rudolf Polzer reported that a2ps will execute shell commands contained within filenames. A user can create a specially crafted filename that, when processed by a2ps, will execute shell commands with the privileges of the a2ps process.

Impact:   A user can cause arbitrary shell commands to be executed by a2ps.
Solution:   Gentoo has released a fix and indicates that all a2ps users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/a2ps-4.13c-r2"

Vendor URL:  www.gnu.org/software/a2ps/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Gentoo)

Message History:   This archive entry is a follow-up to the message listed below.
Dec 10 2004 a2ps Executes Shell Commands Contained Within Filenames



 Source Message Contents

Subject:  [gentoo-announce] [ GLSA 200501-02 ] a2ps: Insecure temporary files handling


This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigD1F9B887E222A6014CFBD3E6
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200501-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: a2ps: Insecure temporary files handling
      Date: January 04, 2005
      Bugs: #75784
        ID: 200501-02

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

The fixps and psmandup scripts in the a2ps package are vulnerable to
symlink attacks, potentially allowing a local user to overwrite
arbitrary files.

Background
==========

a2ps is an Any to Postscript filter that can convert to Postscript from
many filetypes. fixps is a script that fixes errors in Postscript
files. psmandup produces a Postscript file for printing in manual
duplex mode.

Affected packages
=================

    -------------------------------------------------------------------
     Package        /  Vulnerable  /                        Unaffected
    -------------------------------------------------------------------
  1  app-text/a2ps     < 4.13c-r2                          >= 4.13c-r2

Description
===========

Javier Fernandez-Sanguino Pena discovered that the a2ps package
contains two scripts that create insecure temporary files (fixps and
psmandup).

Impact
======

A local attacker could create symbolic links in the temporary files
directory, pointing to a valid file somewhere on the filesystem. When
fixps or psmandup is executed, this would result in the file being
overwritten with the rights of the user running the utility.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All a2ps users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=app-text/a2ps-4.13c-r2"

References
==========

  [ 1 ] Secunia SA13641
        http://secunia.com/advisories/13641/
  [ 2 ] CAN-2004-1170
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1170

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200501-02.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0


--------------enigD1F9B887E222A6014CFBD3E6
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFB2wuOvcL1obalX08RAj9mAJ4sNeFVF/6M0PGYqRJ/H+JzenlliQCeMwi1
aZo47y2NrpUEiI+gN6lZlb4=
=SxAb
-----END PGP SIGNATURE-----

--------------enigD1F9B887E222A6014CFBD3E6--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC