Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.

A buffer overflow has been found in the xpdf viewer. An insufficient input validation of the encryption key length could be exploited by an attacker providing a specially crafted PDF file which, when processed by xpdf, could result in abnormal program termination or the execution of attacker supplied program code with the user's privileges.

The Common UNIX Printing System (CUPS) uses the same code to print PDF files. In this case, this bug could be exploited to gain the privileges of the CUPS print server (by default, user cupsys).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An iDEFENSE Security Advisory reports :

Remote exploitation of a buffer overflow vulnerability in the xpdf PDF viewer included in multiple Unix and Linux distributions could allow for arbitrary code execution as the user viewing a PDF file.

The vulnerability specifically exists due to insufficient bounds checking while processing a PDF file that provides malicious values in the /Encrypt /Length tag. The offending code can be found in the Decrypt::makeFileKey2 function in the source file xpdf/Decrypt.cc.

The remote host is affected by the vulnerability described in GLSA-200506-06 (libextractor: Multiple overflow vulnerabilities)

    Xpdf is vulnerable to multiple overflows, as described in GLSA     200501-28. Also, integer overflows were discovered in Real and PNG     extractors.
  Impact :

    An attacker could design malicious PDF, PNG or Real files which,     when processed by an application making use of libextractor, would     result in the execution of arbitrary code with the rights of the user     running the application.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:026 advisory.

    The tetex packages (teTeX) contain an implementation of TeX for Linux or     UNIX systems.

    A buffer overflow flaw was found in the Gfx::doImage function of Xpdf which     also affects teTeX due to a shared codebase. An attacker could construct a     carefully crafted PDF file that could cause teTeX to crash or possibly     execute arbitrary code when opened. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2004-1125 to     this issue.

    A buffer overflow flaw was found in the Decrypt::makeFileKey2 function of     Xpdf which also affects teTeX due to a shared codebase. An attacker could     construct a carefully crafted PDF file that could cause teTeX to crash or     possibly execute arbitrary code when opened. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-0064 to     this issue.

    Users should update to these erratum packages which contain backported     patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:066 advisory.

    The kdegraphics packages contain applications for the K Desktop Environment     including kpdf, a pdf file viewer.

    A buffer overflow flaw was found in the Gfx::doImage function of Xpdf that     also affects kpdf due to a shared codebase. An attacker could construct a     carefully crafted PDF file that could cause kpdf to crash or possibly     execute arbitrary code when opened. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2004-1125 to     this issue.

    A buffer overflow flaw was found in the Decrypt::makeFileKey2 function of     Xpdf which also affects kpdf due to a shared codebase. An attacker could     construct a carefully crafted PDF file that could cause kpdf to crash or     possibly execute arbitrary code when opened. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-0064 to     this issue.

    During a source code audit, Chris Evans and others discovered a number of     integer overflow bugs that affected all versions of Xpdf which also affects     kpdf due to a shared codebase. An attacker could construct a carefully     crafted PDF file that could cause kpdf to crash or possibly execute     arbitrary code when opened. The Common Vulnerabilities and Exposures     project (cve.mitre.org) has assigned the name CAN-2004-0888 to this issue.

    Users should update to these erratum packages which contain backported     patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:057 advisory.

    GPdf is a viewer for Portable Document Format (PDF) files for GNOME.

    A buffer overflow flaw was found in the Gfx::doImage function of Xpdf which     also affects GPdf due to a shared codebase. An attacker could construct a     carefully crafted PDF file that could cause GPdf to crash or possibly     execute arbitrary code when opened. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2004-1125 to     this issue.

    A buffer overflow flaw was found in the Decrypt::makeFileKey2 function of     Xpdf which also affects GPdf due to a shared codebase. An attacker could     construct a carefully crafted PDF file that could cause GPdf to crash or     possibly execute arbitrary code when opened. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-0064 to     this issue.

    During a source code audit, Chris Evans and others discovered a number of     integer overflow bugs that affected all versions of Xpdf, which also     affects GPdf due to a shared codebase. An attacker could construct a     carefully crafted PDF file that could cause GPdf to crash or possibly     execute arbitrary code when opened.  This issue was assigned the name     CAN-2004-0888 by The Common Vulnerabilities and Exposures project     (cve.mitre.org). Red Hat Enterprise Linux 4 contained a fix for this issue,     but it was found to be incomplete and left 64-bit architectures vulnerable.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2005-0206 to this issue.

    Users should update to this erratum package which contains backported     patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:053 advisory.

    The Common UNIX Printing System provides a portable printing layer for     UNIX(R) operating systems.

    During a source code audit, Chris Evans and others discovered a number of     integer overflow bugs that affected all versions of Xpdf, which also     affects CUPS due to a shared codebase. An attacker could construct a     carefully crafted PDF file that could cause CUPS to crash or possibly     execute arbitrary code when opened.  This issue was assigned the name     CAN-2004-0888 by The Common Vulnerabilities and Exposures project     (cve.mitre.org). Red Hat Enterprise Linux 4 contained a fix for this issue,     but it was found to be incomplete and left 64-bit architectures vulnerable.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2005-0206 to this issue.

    A buffer overflow flaw was found in the Gfx::doImage function of Xpdf which     also affects the CUPS pdftops filter due to a shared codebase.  An attacker     who has the ability to send a malicious PDF file to a printer could     possibly execute arbitrary code as the lp user. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2004-1125 to this issue.

    A buffer overflow flaw was found in the ParseCommand function in the     hpgltops program. An attacker who has the ability to send a malicious HPGL     file to a printer could possibly execute arbitrary code as the lp user.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2004-1267 to this issue.

    A buffer overflow flaw was found in the Decrypt::makeFileKey2 function of     Xpdf which also affects the CUPS pdftops filter due to a shared codebase.
    An attacker who has the ability to send a malicious PDF file to a printer     could possibly execute arbitrary code as the lp user. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2005-0064 to this issue.

    The lppasswd utility was found to ignore write errors when modifying the     CUPS passwd file. A local user who is able to fill the associated file     system could corrupt the CUPS password file or prevent future uses of     lppasswd. The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the names CAN-2004-1268 and CAN-2004-1269 to these issues.

    The lppasswd utility was found to not verify that the passwd.new file is     different from STDERR, which could allow local users to control output to     passwd.new via certain user input that triggers an error message. The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2004-1270 to this issue.

    All users of cups should upgrade to these updated packages, which contain     backported patches to resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:034 advisory.

    Xpdf is an X Window System based viewer for Portable Document Format (PDF)     files.

    A buffer overflow flaw was found in the Gfx::doImage function of Xpdf. An     attacker could construct a carefully crafted PDF file that could cause Xpdf     to crash or possibly execute arbitrary code when opened. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2004-1125 to this issue.

    A buffer overflow flaw was found in the Decrypt::makeFileKey2 function of     Xpdf. An attacker could construct a carefully crafted PDF file that could     cause Xpdf to crash or possibly execute arbitrary code when opened. The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2005-0064 to this issue.

    During a source code audit, Chris Evans and others discovered a number of     integer overflow bugs that affected all versions of Xpdf. An attacker could     construct a carefully crafted PDF file that could cause Xpdf to crash or     possibly execute arbitrary code when opened. This issue was assigned the     name CAN-2004-0888 by The Common Vulnerabilities and Exposures project     (cve.mitre.org).  Red Hat Enterprise Linux 4 contained a fix for this     issue, but it was found to be incomplete and left 64-bit architectures     vulnerable.  The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0206 to this issue.

    All users of Xpdf should upgrade to this updated package, which contains     backported patches to resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200502-10 (pdftohtml: Vulnerabilities in included Xpdf)

    Xpdf is vulnerable to a buffer overflow, as described in GLSA     200501-28.
  Impact :

    An attacker could entice a user to convert a specially crafted PDF     file, potentially resulting in the execution of arbitrary code with the     rights of the user running pdftohtml.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200501-32 (KPdf, KOffice: Stack overflow in included Xpdf code)

    KPdf and KOffice both include Xpdf code to handle PDF files. Xpdf     is vulnerable to a new stack overflow, as described in GLSA 200501-28.
  Impact :

    An attacker could entice a user to open a specially crafted PDF     file, potentially resulting in the execution of arbitrary code with the     rights of the user running the affected application.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200501-31 (teTeX, pTeX, CSTeX: Multiple vulnerabilities)

    teTeX, pTeX and CSTeX all make use of Xpdf code and may therefore     be vulnerable to the various overflows that were discovered in Xpdf     code (CAN-2004-0888, CAN-2004-0889, CAN-2004-1125 and CAN-2005-0064).
    Furthermore, Javier Fernandez-Sanguino Pena discovered that the     xdvizilla script does not handle temporary files correctly.
  Impact :

    An attacker could design a malicious input file which, when     processed using one of the TeX distributions, could lead to the     execution of arbitrary code. Furthermore, a local attacker could create     symbolic links in the temporary files directory, pointing to a valid     file somewhere on the filesystem. When xdvizilla is called, this would     result in the file being overwritten with the rights of the user     running the script.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200501-30 (CUPS: Stack overflow in included Xpdf code)

    The Decrypt::makeFileKey2 function in Xpdf's Decrypt.cc     insufficiently checks boundaries when processing /Encrypt /Length tags     in PDF files (GLSA 200501-28).
  Impact :

    This issue could be exploited by a remote attacker to execute     arbitrary code by sending a malicious print job to a CUPS spooler.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200501-28 (Xpdf, GPdf: Stack overflow in Decrypt::makeFileKey2)

    iDEFENSE reports that the Decrypt::makeFileKey2 function in Xpdf's     Decrypt.cc insufficiently checks boundaries when processing /Encrypt     /Length tags in PDF files.
  Impact :

    An attacker could entice an user to open a specially crafted PDF     file which would trigger a stack overflow, potentially resulting in     execution of arbitrary code with the rights of the user running Xpdf or     GPdf.
  Workaround :

    There is no known workaround at this time.

Updated CUPS packages that fixes a security issue are now available.

The Common UNIX Printing System provides a portable printing layer for UNIX(R) operating systems.

A buffer overflow flaw was found in the Decrypt::makeFileKey2 function of Xpdf which also affects the CUPS pdftops filter due to a shared codebase. An attacker who has the ability to send a malicious PDF file to a printer could possibly execute arbitrary code as the 'lp' user.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0064 to this issue.

Red Hat believes that the Exec-Shield technology (enabled by default since Update 3) will block attempts to remotely exploit these buffer overflow vulnerabilities on x86 architectures.

All users of cups should upgrade to these updated packages, which resolve these issues.

Updated Xpdf package that fixes a stack based buffer overflow security issue is now available.

Xpdf is an X Window System based viewer for Portable Document Format (PDF) files.

A buffer overflow flaw was found when processing the /Encrypt /Length tag. An attacker could construct a carefully crafted PDF file that could cause Xpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0064 to this issue.

Red Hat believes that the Exec-Shield technology (enabled by default since Update 3) will block attempts to exploit this vulnerability on x86 architectures.

All users of the Xpdf package should upgrade to this updated package, which resolves this issue

A buffer overflow vulnerability was discovered in the xpdf PDF code, which could allow for arbitrary code execution as the user viewing a PDF file. The vulnerability exists due to insufficient bounds checking while processing a PDF file that provides malicious values in the /Encrypt /Length tag. Tetex uses xpdf code and is susceptible to the same vulnerability.

The updated packages have been patched to prevent these problems.

A buffer overflow vulnerability was discovered in the xpdf PDF code, which could allow for arbitrary code execution as the user viewing a PDF file. The vulnerability exists due to insufficient bounds checking while processing a PDF file that provides malicious values in the /Encrypt /Length tag. Kdegraphics uses xpdf code and is susceptible to the same vulnerability.

10.1 packages also include a fix for ksvg kde bug #74457.

The updated packages have been patched to prevent these problems.

A buffer overflow vulnerability was discovered in the xpdf PDF code, which could allow for arbitrary code execution as the user viewing a PDF file. The vulnerability exists due to insufficient bounds checking while processing a PDF file that provides malicious values in the /Encrypt /Length tag. Koffice uses xpdf code and is susceptible to the same vulnerability.

The updated packages have been patched to prevent these problems.

A buffer overflow vulnerability was discovered in the xpdf PDF code, which could allow for arbitrary code execution as the user viewing a PDF file. The vulnerability exists due to insufficient bounds checking while processing a PDF file that provides malicious values in the /Encrypt /Length tag. Cups uses xpdf code and is susceptible to the same vulnerability.

The updated packages have been patched to prevent these problems.

A buffer overflow vulnerability was discovered in the xpdf PDF viewer, which could allow for arbitrary code execution as the user viewing a PDF file. The vulnerability exists due to insufficient bounds checking while processing a PDF file that provides malicious values in the /Encrypt /Length tag.

The updated packages have been patched to prevent these problems.

A buffer overflow vulnerability was discovered in the xpdf PDF code, which could allow for arbitrary code execution as the user viewing a PDF file. The vulnerability exists due to insufficient bounds checking while processing a PDF file that provides malicious values in the /Encrypt /Length tag. Gpdf uses xpdf code and is susceptible to the same vulnerability.

The updated packages have been patched to prevent these problems.

iDEFENSE has reported a buffer overflow in xpdf, the portable document format (PDF) suite. A maliciously crafted PDF file could exploit this problem, resulting in the execution of arbitrary code.

iDEFENSE has reported a buffer overflow in xpdf, the portable document format (PDF) suite. Similar code is present in the PDF processing part of CUPS. A maliciously crafted PDF file could exploit this problem, resulting in the execution of arbitrary code.

ID	Name	Product	Family	Severity
20683	Ubuntu 4.10 : xpdf, cupsys vulnerabilities (USN-64-1)	Nessus	Ubuntu Local Security Checks	high
19176	FreeBSD : xpdf -- makeFileKey2() buffer overflow vulnerability (f755545e-6fcd-11d9-abec-00061bd2d56f)	Nessus	FreeBSD Local Security Checks	high
18448	GLSA-200506-06 : libextractor: Multiple overflow vulnerabilities	Nessus	Gentoo Local Security Checks	high
17338	RHEL 4 : tetex (RHSA-2005:026)	Nessus	Red Hat Local Security Checks	high
17178	RHEL 4 : kdegraphics (RHSA-2005:066)	Nessus	Red Hat Local Security Checks	high
17175	RHEL 4 : gpdf (RHSA-2005:057)	Nessus	Red Hat Local Security Checks	high
17174	RHEL 4 : CUPS (RHSA-2005:053)	Nessus	Red Hat Local Security Checks	high
17168	RHEL 4 : xpdf (RHSA-2005:034)	Nessus	Red Hat Local Security Checks	high
16447	GLSA-200502-10 : pdftohtml: Vulnerabilities in included Xpdf	Nessus	Gentoo Local Security Checks	high
16423	GLSA-200501-32 : KPdf, KOffice: Stack overflow in included Xpdf code	Nessus	Gentoo Local Security Checks	high
16422	GLSA-200501-31 : teTeX, pTeX, CSTeX: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
16421	GLSA-200501-30 : CUPS: Stack overflow in included Xpdf code	Nessus	Gentoo Local Security Checks	high
16419	GLSA-200501-28 : Xpdf, GPdf: Stack overflow in Decrypt::makeFileKey2	Nessus	Gentoo Local Security Checks	high
16297	RHEL 3 : cups (RHSA-2005:049)	Nessus	Red Hat Local Security Checks	high
16263	RHEL 3 : xpdf (RHSA-2005:059)	Nessus	Red Hat Local Security Checks	high
16258	Mandrake Linux Security Advisory : tetex (MDKSA-2005:021)	Nessus	Mandriva Local Security Checks	high
16257	Mandrake Linux Security Advisory : kdegraphics (MDKSA-2005:020)	Nessus	Mandriva Local Security Checks	high
16256	Mandrake Linux Security Advisory : koffice (MDKSA-2005:019)	Nessus	Mandriva Local Security Checks	high
16255	Mandrake Linux Security Advisory : cups (MDKSA-2005:018)	Nessus	Mandriva Local Security Checks	high
16254	Mandrake Linux Security Advisory : xpdf (MDKSA-2005:017)	Nessus	Mandriva Local Security Checks	high
16253	Mandrake Linux Security Advisory : gpdf (MDKSA-2005:016)	Nessus	Mandriva Local Security Checks	high
16215	Debian DSA-648-1 : xpdf - buffer overflow	Nessus	Debian Local Security Checks	high
16212	Debian DSA-645-1 : cupsys - buffer overflow	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2005-0064

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high