[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] CVE request - pdfjam
From:       Robert Buchholz <rbu () gentoo ! org>
Date:       2008-12-28 13:55:57
Message-ID: 200812281456.07346.rbu () gentoo ! org
[Download RAW message or body]


On Friday 19 December 2008, Tomas Hoger wrote:
> Hi!
>
> Insecure temporary file handling flaw was reported for pdfjam:
>
> https://bugzilla.novell.com/show_bug.cgi?id=459031
>
> Issue affects all 3 scripts shipped in pdfjam: pdf90, pdfjoin and
> pdfnup
>
> They create various temporary files in tempfileDir (/var/tmp),
> process id ($$) is used for file name uniqueness.

Martin Väth also discovered an untrusted search path vulnerability in 
the pdfjam scripts: They prepend . to PATH, allowing attackers to 
execute code by preparing executables (e.g. sed) in the directory 
pdfnup was run from or in /var/tmp (e.g. pdflatex, cp, rm).

Martin also prepared a patch, see:
https://bugs.gentoo.org/show_bug.cgi?id=252734

Please assign another CVE for this issue.

Robert

["signature.asc" (application/pgp-signature)]

[prev in list] [next in list] [prev in thread] [next in thread]