Detections
Analytics
CentOS 3 / 4 : netpbm (CESA-2008:0131)
medium Nessus Plugin ID 31301
Synopsis
The remote CentOS host is missing one or more security updates.Description
Updated netpbm packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, 3, and 4.This update has been rated as having moderate security impact by the Red Hat Security Response Team.
The netpbm package contains a library of functions for editing and converting between various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps) and others. The package includes no interactive tools and is primarily used by other programs (eg CGI scripts that manage website images).
An input validation flaw was discovered in the GIF-to-PNM converter (giftopnm) shipped with the netpbm package. An attacker could create a carefully crafted GIF file which could cause giftopnm to crash or possibly execute arbitrary code as the user running giftopnm.
(CVE-2008-0554)
All users are advised to upgrade to these updated packages which contain a backported patch which resolves this issue.
Solution
Update the affected netpbm packages.See Also
http://www.nessus.org/u?375723a1
http://www.nessus.org/u?06c68e04
http://www.nessus.org/u?25201b88
http://www.nessus.org/u?f063c6ea
Plugin Details
Severity: Medium
ID: 31301
File Name: centos_RHSA-2008-0131.nasl
Version: 1.15
Type: local
Agent: unix
Family: CentOS Local Security Checks
Published: 2/28/2008
Updated: 1/4/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/o:centos:centos:3, p-cpe:/a:centos:centos:netpbm-devel, p-cpe:/a:centos:centos:netpbm-progs, cpe:/o:centos:centos:4, p-cpe:/a:centos:centos:netpbm
Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list
Patch Publication Date: 2/29/2008
Vulnerability Publication Date: 2/7/2008
Reference Information
CVE: CVE-2008-0554