SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Poppler Vendors:   Freedesktop.org
Poppler Memory Allocation Bug in 'Page.cc' Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1020435
SecurityTracker URL:  http://securitytracker.com/id/1020435
CVE Reference:   CVE-2008-2950   (Links to External Site)
Date:  Jul 8 2008
Impact:   Execution of arbitrary code via network, User access via network
Vendor Confirmed:  Yes  
Version(s): 0.8.4 and prior versions
Description:   A vulnerability was reported in Poppler. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted PDF file that, when processed by the target application, will trigger a memory allocation error in the Page class constructor/destructor and execute arbitrary code on the target system. The code will run with the privileges of the target application.

The vulnerability resides in 'poppler/Page.cc'.

The vendor was notified on June 28, 2008.

Felipe Andres Manzano reported this vulnerability.

The original advisory is available at:

http://www.ocert.org/advisories/ocert-2008-007.html

Impact:   A remote user can create a PDF file that, when processed by the target application, will execute arbitrary code on the target system.
Solution:   No solution was available at the time of this entry.

The vendor plans to issue a fix at the end of July 2008.

Vendor URL:  poppler.freedesktop.org/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  [oCERT-2008-007] libpoppler uninitialized pointer


2008/07/07 #2008-007 libpoppler uninitialized pointer

Description:

The poppler PDF rendering library suffers a memory management bug which leads
to arbitrary code execution.

The vulnerability is present in the Page class constructor/destructor. The
pageWidgets object is not initialized in the Page constructor if specific
conditions are met, but it is deleted afterwards in the destructor regardless
of its initialization.

Specific PDF files can be crafted which allocate arbitrary memory to trigger
the vulnerability.

A new poppler version addressing the issue is scheduled to be released on
July 30th according to maintainer.

The following patch fixes the issue:


diff --git a/poppler/Page.cc b/poppler/Page.cc
index b28a3ee..72a706b 100644
--- a/poppler/Page.cc
+++ b/poppler/Page.cc
@@ -230,7 +230,7 @@ GBool PageAttrs::readBox(Dict *dict, char *key, PDFRectangle *box) {
 
 Page::Page(XRef *xrefA, int numA, Dict *pageDict, PageAttrs *attrsA, Form *form) {
   Object tmp;
-	
+  pageWidgets =	NULL;  //Security fix
   ok = gTrue;
   xref = xrefA;
   num = numA;


Affected version:

poppler <= 0.8.4

Fixed version:

poppler, N/A

Credit: vulnerability report, patch and PoC code received from Felipe Andres
Manzano <fmanzano [at] fceia [dot] unr [dot] edu [dot] ar>.

CVE: CVE-2008-2950

Timeline:
2008-06-27: vulnerability report received
2008-06-28: contacted poppler maintainers and affected vendors
2008-06-30: maintainer confirms issue and patch
2008-07-07: advisory release

References:

Links:
http://poppler.freedesktop.org

Permalink:
http://www.ocert.org/advisories/ocert-2008-007.html

-- 
Andrea Barisani |                Founder & Project Coordinator
          oCERT | Open Source Computer Emergency Response Team

<lcars@ocert.org>                         http://www.ocert.org
 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
        "Pluralitas non est ponenda sine necessitate"

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC