gv sscanf() function buffer overflow
| gv-sscanf-function-bo (10201) |  High Risk |
Description:
The gv program is vulnerable to a buffer overflow when the sscanf() function is called. By sending a specially-crafted PostScript or PDF file to a gv user, a remote attacker could overflow a buffer and execute code on the system with the same privileges as the victim, once the malicious file is opened.
Consequences:
Gain Access
Remedy:
For Red Hat Powertools:
Upgrade to the latest ggv package, as listed below. Refer to Red Hat Security Advisory RHSA-2002:212-06 for more information. See References.
Red Hat Powertools 7.0 and 7.1: 1.0.2-5.1 or later
For Red Hat Linux:
Upgrade to the latest kdegraphics package, as listed below. Refer to RHSA-2002:220-41 for more information. See References.
Red Hat Linux 7.2: 2.2.2-2.1 or later
Red Hat Linux 7.3: 3.0.3-0.7.2 or later
Red Hat Linux 8.0: 3.0.3-5 or later
For Red Hat Linux:
Upgrade to the latest gv package, as listed below. Refer to RHSA-2002:207-17 for more information. See References.
Red Hat Linux 6.2: 3.5.8-18.6x or later
Red Hat Linux 7.0 and 7.1 and for iSeries, 7.2, and 7.3: 3.5.8-18.7x or later
Red Hat Linux 8.0: 3.5.8-19 or later
For KDE KGhostView:
Apply the appropriate patch for your system, as listed in KDE Security Advisory 2002-10-08. See References.
For Debian GNU/Linux containing the gv package:
Upgrade to the latest gv package, as listed below. Refer to DSA-176-1 for more information. See References.
Debian GNU/Linux 2.2: 3.5.8-17.1 or later
Debian GNU/Linux 3.0: 3.5.8-26.1 or later
For Debian GNU/Linux containing the gnome-gv package:
Upgrade to the latest gnome-gv package, as listed below. Refer to DSA-179-1 for more information. See References.
Debian GNU/Linux 2.2: 0.82-2.1 or later
Debian DNU/Linux 3.0: 1.1.96-3.1 or later
For Mandrake Linux containing the gv package:
Upgrade to the latest gv package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2002:069 for more information. See References.
Mandrake Linux 8.0: 3.5.8-18.1mdk or later
Mandrake Linux 8.1, 8.2 and 9.0: 3.5.8-27.1mdk or later
For Mandrake Linux containing the ggv package:
Upgrade to the latest ggv package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2002:069 for more information. See References.
Mandrake Linux 8.0 and 8.1: 1.1.0-1.1mdk or later
Mandrake Linux 8.2: 1.1.94-2.1mdk or later
Mandrake Linux 9.0: 1.99.9-1.1mdk or later
For Mandrake Linux containing the kdegraphics package:
Upgrade to the latest kdegraphics package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2002:071 : kdegraphics for more information. See References.
Mandrake Linux 8.1: 2.2.1-2.1mdk or later
Mandrake Linux 8.2: 2.2.2-15.1mdk or later
Mandrake Linux 9.0: 3.0.3-11.1mdk or later
For Debian GNU/Linux containing the kghostview package:
Upgrade to the latest kghostview package, as listed below. Refer to DSA-182-1 for more information. See References.
Debian 3.0: 2.2.2-6.8 or later
For Conectiva Linux:
Upgrade to the latest gv package, as listed below. Refer to Conectiva Linux Announcement CLSA-2002:542 for more information. See References.
Conectiva Linux 6.0: 3.5.8-15U60_1cl or later
Conectiva Linux 7.0: 3.5.8-16U70_1cl or later
Conectiva Linux 8.0: 3.5.8-17U80_1cl or later
For Gentoo Linux:
Upgrade to the latest version of gv (3.5.8-r4 or later), as listed in GLSA 200408-10. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- BugTraq Mailing List, 2002-09-26 16:13:43: Errata: iDEFENSE Security Advisory 09.26.2002: Exploitable Buffer Overflow in gv.
- CIAC Information Bulletin N-020: Red Hat Multiple Vulnerabilities in KDE.
- Conectiva Linux Announcement CLSA-2002:542: gv/kghostview.
- Gentoo Linux Security Announcement 200210-003: ggv. (From Neohapsis archive.)
- iDEFENSE Security Advisory 09.26.2002: Exploitable Buffer Overflow in gv.
- KDE Security Advisory 2002-10-08: KGhostview Arbitary Code Execution.
- SCO Security Advisory CSSA-2002-053.0: Linux: gv execution of arbitrary shell commands.
- Sun Alert ID: 47780: Sun Linux Security Vulnerability in "gv" ("Ghostview") Command.
- BID-5808: GV Malformed PDF/PS File Buffer Overflow Vulnerability
- BID-581: Ircd hybrid-6 Buffer Overflow Vulnerability
- CVE-2002-0838: Buffer overflow in (1) gv 3.5.8 and earlier, (2) gvv 1.0.2 and earlier, (3) ggv 1.99.90 and earlier, (4) gnome-gv, and (5) kghostview in kdegraphics 2.2.2 and earlier, allows attackers to execute arbitrary code via a malformed (a) PDF or (b) PostScript file, which is processed by an unsafe call to sscanf.
- DSA-176: gv -- buffer overflow
- DSA-179: gnome-gv -- buffer overflow
- DSA-182: kdegraphics -- buffer overflow
- GLSA-200408-10: gv: Exploitable Buffer Overflow
- MDKSA-2002:069: Updated gv/ggv packages fix command execution vulnerabilities
- RHSA-2002-207: Updated packages fix PostScript and PDF security issue
- RHSA-2002-211: ggv security update
- RHSA-2002-212: Updated packages fix PostScript and PDF security issue
- RHSA-2002-220: Updated KDE packages fix security issues
- US-CERT VU#600777: gv contains buffer overflow in sscanf() function
Platforms Affected:
- Conectiva Linux 6.0
- Conectiva Linux 7.0
- Conectiva Linux 8.0
- Debian Debian Linux 2.2
- Debian Debian Linux 3.0
- Gentoo Linux
- GNU GV 3.5.8
- KDE KDE 1.1 - 3.0.3a
- MandrakeSoft Mandrake Linux 8.0
- MandrakeSoft Mandrake Linux 8.0 PPC
- MandrakeSoft Mandrake Linux 8.1
- MandrakeSoft Mandrake Linux 8.1 IA64
- MandrakeSoft Mandrake Linux 8.2 PPC
- MandrakeSoft Mandrake Linux 8.2
- MandrakeSoft Mandrake Linux 9.0
- RedHat Enterprise Linux 2.1 AS
- RedHat Linux 6.2
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.1 for iSeries
- RedHat Linux 7.1 for pSeries
- RedHat Linux 7.2
- RedHat Linux 7.3
- RedHat Linux 8.0
- RedHat Linux Advanced Workstation 2.1 Itanium
- RedHat Linux Powertools 7.0
- RedHat Linux Powertools 7.1
Reported:
Sep 26, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net