Detections
Analytics
Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : tetex-bin, texlive-bin vulnerabilities (USN-554-1)
medium Nessus Plugin ID 29239
Synopsis
The remote Ubuntu host is missing one or more security-related patches.Description
Bastien Roucaries discovered that dvips as included in tetex-bin and texlive-bin did not properly perform bounds checking. If a user or automated system were tricked into processing a specially crafted dvi file, dvips could be made to crash and execute code as the user invoking the program. (CVE-2007-5935)Joachim Schrod discovered that the dviljk utilities created temporary files in an insecure way. Local users could exploit a race condition to create or overwrite files with the privileges of the user invoking the program. (CVE-2007-5936)
Joachim Schrod discovered that the dviljk utilities did not perform bounds checking in many instances. If a user or automated system were tricked into processing a specially crafted dvi file, the dviljk utilities could be made to crash and execute code as the user invoking the program. (CVE-2007-5937).
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Medium
ID: 29239
File Name: ubuntu_USN-554-1.nasl
Version: 1.15
Type: local
Agent: unix
Family: Ubuntu Local Security Checks
Published: 12/7/2007
Updated: 1/19/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:canonical:ubuntu_linux:texlive-music, cpe:/o:canonical:ubuntu_linux:7.04, p-cpe:/a:canonical:ubuntu_linux:texlive-font-utils, p-cpe:/a:canonical:ubuntu_linux:libkpathsea-dev, p-cpe:/a:canonical:ubuntu_linux:texlive-xetex, p-cpe:/a:canonical:ubuntu_linux:texlive-omega, p-cpe:/a:canonical:ubuntu_linux:libkpathsea4, cpe:/o:canonical:ubuntu_linux:7.10, p-cpe:/a:canonical:ubuntu_linux:texlive-extra-utils, cpe:/o:canonical:ubuntu_linux:6.06:-:lts, p-cpe:/a:canonical:ubuntu_linux:libkpathsea4-dev, cpe:/o:canonical:ubuntu_linux:6.10, p-cpe:/a:canonical:ubuntu_linux:texlive-lang-indic, p-cpe:/a:canonical:ubuntu_linux:texlive-base-bin, p-cpe:/a:canonical:ubuntu_linux:texlive-metapost, p-cpe:/a:canonical:ubuntu_linux:tetex-bin
Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l
Patch Publication Date: 12/6/2007