The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such as Red Hat, which could leave Xpdf users exposed to the original vulnerabilities.

From Red Hat Security Advisory 2008:0206 :

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

Two overflows were discovered in the HP-GL/2-to-PostScript filter. An attacker could create a malicious HP-GL/2 file that could possibly execute arbitrary code as the 'lp' user if the file is printed.
(CVE-2008-0053)

A buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters 'imagetops' and 'imagetoraster'.
An attacker could create a malicious GIF file that could possibly execute arbitrary code as the 'lp' user if the file was printed.
(CVE-2008-1373)

It was discovered that the patch used to address CVE-2004-0888 in CUPS packages in Red Hat Enterprise Linux 3 and 4 did not completely resolve the integer overflow in the 'pdftops' filter on 64-bit platforms. An attacker could create a malicious PDF file that could possibly execute arbitrary code as the 'lp' user if the file was printed. (CVE-2008-1374)

All cups users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform.
(formerly CVE-2004-0888). This also affects applications like koffice, that use embedded versions of xpdf.

The updated packages are patched to deal with these issues.

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform.
(formerly CVE-2004-0888). This also affects applications like tetex, that use embedded versions of xpdf.

The updated packages are patched to deal with these issues.

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform.
(formerly CVE-2004-0888). This also affects applications that use embedded versions of xpdf.

The updated packages are patched to deal with these issues.

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform.
(formerly CVE-2004-0888). This also affects applications like gpdf, that use embedded versions of xpdf.

The updated packages are patched to deal with these issues.

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform.
(formerly CVE-2004-0888). This also affects applications like cups, that use embedded versions of xpdf.

The updated packages are patched to deal with these issues.

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

Two overflows were discovered in the HP-GL/2-to-PostScript filter. An attacker could create a malicious HP-GL/2 file that could possibly execute arbitrary code as the 'lp' user if the file is printed.
(CVE-2008-0053)

A buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters 'imagetops' and 'imagetoraster'.
An attacker could create a malicious GIF file that could possibly execute arbitrary code as the 'lp' user if the file was printed.
(CVE-2008-1373)

It was discovered that the patch used to address CVE-2004-0888 in CUPS packages in Red Hat Enterprise Linux 3 and 4 did not completely resolve the integer overflow in the 'pdftops' filter on 64-bit platforms. An attacker could create a malicious PDF file that could possibly execute arbitrary code as the 'lp' user if the file was printed. (CVE-2008-1374)

All cups users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote host is missing Security Update 2005-005. This security
update contains security fixes for the following application :

- Apache
- AppKit
- AppleScript
- Bluetooth
- Directory Services
- Finder
- Foundation
- HelpViewer
- LDAP
- libXpm
- lukemftpd
- NetInfo
- ServerAdmin
- sudo
- Terminal
- VPN 

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform.
(formerly CVE-2004-0888). This also affects applications like kdegraphics, that use embedded versions of xpdf. (CVE-2005-0206)

In addition, previous libtiff updates overlooked kdegraphics, which contains and embedded libtiff used for kfax. This update includes patches to address: CVE-2004-0803, CVE-2004-0804, CVE-2004-0886, CVE-2004-1183, CVE-2004-1308.

The updated packages are patched to deal with these issues.

An updated xpdf package that correctly fixes several integer overflows is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The xpdf package is an X Window System-based viewer for Portable Document Format (PDF) files.

During a source code audit, Chris Evans and others discovered a number of integer overflow bugs that affected all versions of Xpdf. An attacker could construct a carefully crafted PDF file that could cause Xpdf to crash or possibly execute arbitrary code when opened. This issue was assigned the name CVE-2004-0888 by The Common Vulnerabilities and Exposures project (cve.mitre.org). RHSA-2004:592 contained a fix for this issue, but it was found to be incomplete and left 64-bit architectures vulnerable. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0206 to this issue.

All users of xpdf should upgrade to this updated package, which contains backported patches to resolve these issues.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:057 advisory.

    GPdf is a viewer for Portable Document Format (PDF) files for GNOME.

    A buffer overflow flaw was found in the Gfx::doImage function of Xpdf which     also affects GPdf due to a shared codebase. An attacker could construct a     carefully crafted PDF file that could cause GPdf to crash or possibly     execute arbitrary code when opened. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2004-1125 to     this issue.

    A buffer overflow flaw was found in the Decrypt::makeFileKey2 function of     Xpdf which also affects GPdf due to a shared codebase. An attacker could     construct a carefully crafted PDF file that could cause GPdf to crash or     possibly execute arbitrary code when opened. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-0064 to     this issue.

    During a source code audit, Chris Evans and others discovered a number of     integer overflow bugs that affected all versions of Xpdf, which also     affects GPdf due to a shared codebase. An attacker could construct a     carefully crafted PDF file that could cause GPdf to crash or possibly     execute arbitrary code when opened.  This issue was assigned the name     CAN-2004-0888 by The Common Vulnerabilities and Exposures project     (cve.mitre.org). Red Hat Enterprise Linux 4 contained a fix for this issue,     but it was found to be incomplete and left 64-bit architectures vulnerable.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2005-0206 to this issue.

    Users should update to this erratum package which contains backported     patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:053 advisory.

    The Common UNIX Printing System provides a portable printing layer for     UNIX(R) operating systems.

    During a source code audit, Chris Evans and others discovered a number of     integer overflow bugs that affected all versions of Xpdf, which also     affects CUPS due to a shared codebase. An attacker could construct a     carefully crafted PDF file that could cause CUPS to crash or possibly     execute arbitrary code when opened.  This issue was assigned the name     CAN-2004-0888 by The Common Vulnerabilities and Exposures project     (cve.mitre.org). Red Hat Enterprise Linux 4 contained a fix for this issue,     but it was found to be incomplete and left 64-bit architectures vulnerable.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2005-0206 to this issue.

    A buffer overflow flaw was found in the Gfx::doImage function of Xpdf which     also affects the CUPS pdftops filter due to a shared codebase.  An attacker     who has the ability to send a malicious PDF file to a printer could     possibly execute arbitrary code as the lp user. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2004-1125 to this issue.

    A buffer overflow flaw was found in the ParseCommand function in the     hpgltops program. An attacker who has the ability to send a malicious HPGL     file to a printer could possibly execute arbitrary code as the lp user.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2004-1267 to this issue.

    A buffer overflow flaw was found in the Decrypt::makeFileKey2 function of     Xpdf which also affects the CUPS pdftops filter due to a shared codebase.
    An attacker who has the ability to send a malicious PDF file to a printer     could possibly execute arbitrary code as the lp user. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2005-0064 to this issue.

    The lppasswd utility was found to ignore write errors when modifying the     CUPS passwd file. A local user who is able to fill the associated file     system could corrupt the CUPS password file or prevent future uses of     lppasswd. The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the names CAN-2004-1268 and CAN-2004-1269 to these issues.

    The lppasswd utility was found to not verify that the passwd.new file is     different from STDERR, which could allow local users to control output to     passwd.new via certain user input that triggers an error message. The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2004-1270 to this issue.

    All users of cups should upgrade to these updated packages, which contain     backported patches to resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:034 advisory.

    Xpdf is an X Window System based viewer for Portable Document Format (PDF)     files.

    A buffer overflow flaw was found in the Gfx::doImage function of Xpdf. An     attacker could construct a carefully crafted PDF file that could cause Xpdf     to crash or possibly execute arbitrary code when opened. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2004-1125 to this issue.

    A buffer overflow flaw was found in the Decrypt::makeFileKey2 function of     Xpdf. An attacker could construct a carefully crafted PDF file that could     cause Xpdf to crash or possibly execute arbitrary code when opened. The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2005-0064 to this issue.

    During a source code audit, Chris Evans and others discovered a number of     integer overflow bugs that affected all versions of Xpdf. An attacker could     construct a carefully crafted PDF file that could cause Xpdf to crash or     possibly execute arbitrary code when opened. This issue was assigned the     name CAN-2004-0888 by The Common Vulnerabilities and Exposures project     (cve.mitre.org).  Red Hat Enterprise Linux 4 contained a fix for this     issue, but it was found to be incomplete and left 64-bit architectures     vulnerable.  The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0206 to this issue.

    All users of Xpdf should upgrade to this updated package, which contains     backported patches to resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated cups packages that fix a security issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) is a print spooler.

During a source code audit, Chris Evans discovered a number of integer overflow bugs that affect Xpdf. CUPS contained a copy of the Xpdf code used for parsing PDF files and was therefore affected by these bugs.
The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2004-0888 to this issue, and Red Hat released erratum RHSA-2004:543 with updated packages.

It was found that the patch used to correct this issue was not sufficient and did not fully protect CUPS running on 64-bit architectures. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0206 to this issue.

These updated packages also include a fix that prevents the CUPS initscript from being accidentally replaced.

All users of CUPS on 64-bit architectures should upgrade to these updated packages, which contain a corrected patch and are not vulnerable to these issues.

The remote host is missing Security Update 2005-005. This security
update contains security fixes for the following application :

- Apache
- AppKit
- AppleScript
- Bluetooth
- Directory Services
- Finder
- Foundation
- HelpViewer
- LDAP
- libXpm
- lukemftpd
- NetInfo
- ServerAdmin
- sudo
- Terminal
- VPN

ID	Name	Product	Family	Severity
67674	Oracle Linux 3 / 4 : cups (ELSA-2008-0206)	Nessus	Oracle Linux Local Security Checks	critical
61926	Mandrake Linux Security Advisory : koffice (MDKSA-2005:056)	Nessus	Mandriva Local Security Checks	high
61925	Mandrake Linux Security Advisory : tetex (MDKSA-2005:044)	Nessus	Mandriva Local Security Checks	high
61924	Mandrake Linux Security Advisory : xpdf (MDKSA-2005:043)	Nessus	Mandriva Local Security Checks	high
61923	Mandrake Linux Security Advisory : gpdf (MDKSA-2005:042)	Nessus	Mandriva Local Security Checks	high
61922	Mandrake Linux Security Advisory : cups (MDKSA-2005:041)	Nessus	Mandriva Local Security Checks	high
31756	RHEL 3 / 4 : cups (RHSA-2008:0206)	Nessus	Red Hat Local Security Checks	critical
31741	CentOS 3 / 4 : cups (CESA-2008:0206)	Nessus	CentOS Local Security Checks	critical
2878	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Nessus Network Monitor	Web Clients	high
17281	Mandrake Linux Security Advisory : kdegraphics (MDKSA-2005:052)	Nessus	Mandriva Local Security Checks	critical
17266	RHEL 2.1 / 3 : xpdf (RHSA-2005:213)	Nessus	Red Hat Local Security Checks	high
17175	RHEL 4 : gpdf (RHSA-2005:057)	Nessus	Red Hat Local Security Checks	high
17174	RHEL 4 : CUPS (RHSA-2005:053)	Nessus	Red Hat Local Security Checks	high
17168	RHEL 4 : xpdf (RHSA-2005:034)	Nessus	Red Hat Local Security Checks	high
17149	RHEL 3 : cups (RHSA-2005:132)	Nessus	Red Hat Local Security Checks	high
800799	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2005-0206

critical

Tenable Plugins

critical

high

high

high

high

high

critical

critical

high

critical

high

high

high

high

high

high