Multiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0888.

Chris Evans discovered several integer overflow vulnerabilities in xpdf, a viewer for PDF files. The Common UNIX Printing System (CUPS) also uses the same code to print PDF files. In either case, these vulnerabilities could be exploited by an attacker by providing a specially crafted PDF file which, when processed by CUPS or xpdf, could result in abnormal program termination or the execution of program code supplied by the attacker.

In the case of CUPS, this bug could be exploited to gain the privileges of the CUPS print server (by default, user cupsys).

In the case of xpdf, this bug could be exploited to gain the privileges of the user invoking xpdf.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Markus Meissner discovered even more integer overflow vulnerabilities in xpdf, a viewer for PDF files. These integer overflows can eventually lead to buffer overflows.

The Common UNIX Printing System (CUPS) uses the same code to print PDF files; tetex-bin uses the code to generate PDF output and process included PDF files. In any case, these vulnerabilities could be exploited by an attacker providing a specially crafted PDF file which, when processed by CUPS, xpdf, or pdflatex, could result in abnormal program termination or the execution of program code supplied by the attacker.

In the case of CUPS, this bug could be exploited to gain the privileges of the CUPS print server (by default, user cupsys).

In the cases of xpdf and pdflatex, this bug could be exploited to gain the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Chris Evans discovered several integer arithmetic overflows in the xpdf 2 and xpdf 3 code bases. The flaws have impacts ranging from denial-of-service to arbitrary code execution.

The remote host is missing Security Update 2005-005. This security
update contains security fixes for the following application :

- Apache
- AppKit
- AppleScript
- Bluetooth
- Directory Services
- Finder
- Foundation
- HelpViewer
- LDAP
- libXpm
- lukemftpd
- NetInfo
- ServerAdmin
- sudo
- Terminal
- VPN 

The remote host is affected by the vulnerability described in GLSA-200501-31 (teTeX, pTeX, CSTeX: Multiple vulnerabilities)

    teTeX, pTeX and CSTeX all make use of Xpdf code and may therefore     be vulnerable to the various overflows that were discovered in Xpdf     code (CAN-2004-0888, CAN-2004-0889, CAN-2004-1125 and CAN-2005-0064).
    Furthermore, Javier Fernandez-Sanguino Pena discovered that the     xdvizilla script does not handle temporary files correctly.
  Impact :

    An attacker could design a malicious input file which, when     processed using one of the TeX distributions, could lead to the     execution of arbitrary code. Furthermore, a local attacker could create     symbolic links in the temporary files directory, pointing to a valid     file somewhere on the filesystem. When xdvizilla is called, this would     result in the file being overwritten with the rights of the user     running the script.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200410-30 (GPdf, KPDF, KOffice: Vulnerabilities in included xpdf)

    GPdf, KPDF and KOffice all include xpdf code to handle PDF files. xpdf is     vulnerable to multiple integer overflows, as described in GLSA 200410-20.
  Impact :

    An attacker could entice a user to open a specially crafted PDF file,     potentially resulting in execution of arbitrary code with the rights of the     user running the affected utility.
  Workaround :

    There is no known workaround at this time.

The remote host is missing the patch for the advisory SUSE-SA:2004:039 (xpdf, gpdf, kdegraphics3-pdf, pdftohtml, cups).


Xpdf is a widely used fast PDF file viewer. Various other PDF viewer and PDF conversion tools use xpdf code to accomplish their tasks.
Chris Evans found several integer overflows and arithmetic errors.
Additionally Sebastian Krahmer from the SuSE Security-Team found similar bugs in xpdf 3.
These bugs can be exploited by tricking an user to open a malformated PDF file. As a result the PDF viewer can be crashed or may be even code can be executed.

Chris Evans discovered numerous vulnerabilities in the xpdf package :

Multiple integer overflow issues affecting xpdf-2.0 and xpdf-3.0. Also programs like cups which have embedded versions of xpdf. These can result in writing an arbitrary byte to an attacker controlled location which probably could lead to arbitrary code execution. (CVE-2004-0888)

Multiple integer overflow issues affecting xpdf-3.0 only. These can result in DoS or possibly arbitrary code execution. (CVE-2004-0889)

Chris also discovered issues with infinite loop logic error affecting xpdf-3.0 only.

The updated packages are patched to deal with these issues.

The remote host is affected by the vulnerability described in GLSA-200410-20 (Xpdf, CUPS: Multiple integer overflows)

    Chris Evans discovered multiple integer overflow issues in Xpdf.
  Impact :

    An attacker could entice an user to open a specially crafted PDF file,     potentially resulting in execution of arbitrary code with the rights of the     user running Xpdf. By enticing an user to directly print the PDF file to a     CUPS printer, an attacker could also crash the CUPS spooler or execute     arbitrary code with the rights of the CUPS spooler, which is usually the     'lp' user.
  Workaround :

    There is no known workaround at this time.

The remote host is missing Security Update 2005-005. This security
update contains security fixes for the following application :

- Apache
- AppKit
- AppleScript
- Bluetooth
- Directory Services
- Finder
- Foundation
- HelpViewer
- LDAP
- libXpm
- lukemftpd
- NetInfo
- ServerAdmin
- sudo
- Terminal
- VPN

ID	Name	Product	Family	Severity
20614	Ubuntu 4.10 : xpdf vulnerabilities (USN-2-1)	Nessus	Ubuntu Local Security Checks	critical
20532	Ubuntu 4.10 : xpdf vulnerabilities (USN-14-1)	Nessus	Ubuntu Local Security Checks	critical
19076	FreeBSD : xpdf -- integer overflow vulnerabilities (ad2f3337-26bf-11d9-9289-000c41e2cdad)	Nessus	FreeBSD Local Security Checks	critical
2878	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Nessus Network Monitor	Web Clients	high
16422	GLSA-200501-31 : teTeX, pTeX, CSTeX: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
15582	GLSA-200410-30 : GPdf, KPDF, KOffice: Vulnerabilities in included xpdf	Nessus	Gentoo Local Security Checks	critical
15569	SUSE-SA:2004:039: xpdf, gpdf, kdegraphics3-pdf, pdftohtml, cups	Nessus	SuSE Local Security Checks	critical
15548	Mandrake Linux Security Advisory : xpdf (MDKSA-2004:113)	Nessus	Mandriva Local Security Checks	critical
15539	GLSA-200410-20 : Xpdf, CUPS: Multiple integer overflows	Nessus	Gentoo Local Security Checks	critical
800799	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2004-0889

critical

Tenable Plugins

critical

critical

critical

high

critical

critical

critical

critical

critical

high