To: bugtraqat_private announceat_private security-alertsat_private ______________________________________________________________________________ Caldera International, Inc. Security Advisory Subject: Linux: ghostscript arbitrary command execution Advisory number: CSSA-2002-026.0 Issue date: 2002 June 11 Cross reference: ______________________________________________________________________________ 1. Problem Description An untrusted PostScript file that uses .locksafe or .setsafe to reset the current page device can force the ghostscript program to execute arbitrary commands. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to ghostscript-6.51-10.i386.rpm prior to ghostscript-doc-6.51-10.i386.rpm prior to ghostscript-fonts-6.51-10.i386.rpm prior to ghostscript-fonts-cid-6.51-10.i386.rpm OpenLinux 3.1.1 Workstation prior to ghostscript-6.51-10.i386.rpm prior to ghostscript-doc-6.51-10.i386.rpm prior to ghostscript-fonts-6.51-10.i386.rpm prior to ghostscript-fonts-cid-6.51-10.i386.rpm OpenLinux 3.1 Server prior to ghostscript-6.51-10.i386.rpm prior to ghostscript-doc-6.51-10.i386.rpm prior to ghostscript-fonts-6.51-10.i386.rpm prior to ghostscript-fonts-cid-6.51-10.i386.rpm OpenLinux 3.1 Workstation prior to ghostscript-6.51-10.i386.rpm prior to ghostscript-doc-6.51-10.i386.rpm prior to ghostscript-fonts-6.51-10.i386.rpm prior to ghostscript-fonts-cid-6.51-10.i386.rpm 3. Solution The proper solution is to install the latest packages. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS 4.2 Packages cfabdbccacd4de0268ce15d1dd6a0408 ghostscript-6.51-10.i386.rpm f9bb38edc64d718f8b943d395de7c75a ghostscript-doc-6.51-10.i386.rpm 70a913d9427ce45367710498bab8e065 ghostscript-fonts-6.51-10.i386.rpm 9e2f736b44b9bfa60e51c24847637d48 ghostscript-fonts-cid-6.51-10.i386.rpm 4.3 Installation rpm -Fvh ghostscript-6.51-10.i386.rpm rpm -Fvh ghostscript-doc-6.51-10.i386.rpm rpm -Fvh ghostscript-fonts-6.51-10.i386.rpm rpm -Fvh ghostscript-fonts-cid-6.51-10.i386.rpm 4.4 Source Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS 4.5 Source Packages dba70bda415835cca29139d565936b3f ghostscript-6.51-10.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS 5.2 Packages f8a0bf41a7dd801f6f98d50134143fbd ghostscript-6.51-10.i386.rpm a2d8fbd76bc080146b1a1a964a218850 ghostscript-doc-6.51-10.i386.rpm bccaab1b0a9005ea7d36173e296b444e ghostscript-fonts-6.51-10.i386.rpm dadf94bb7c6091cfb32d650a61e8864d ghostscript-fonts-cid-6.51-10.i386.rpm 5.3 Installation rpm -Fvh ghostscript-6.51-10.i386.rpm rpm -Fvh ghostscript-doc-6.51-10.i386.rpm rpm -Fvh ghostscript-fonts-6.51-10.i386.rpm rpm -Fvh ghostscript-fonts-cid-6.51-10.i386.rpm 5.4 Source Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS 5.5 Source Packages 38ebafe42e38f5eae8207c4f52bbb90d ghostscript-6.51-10.src.rpm 6. OpenLinux 3.1 Server 6.1 Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS 6.2 Packages 12aa5320c2331010736ce36a9fc1ef3d ghostscript-6.51-10.i386.rpm 1a40569d1a9598df507faae191e68c48 ghostscript-doc-6.51-10.i386.rpm f44b0f45f4864d2b357b02642c4cd249 ghostscript-fonts-6.51-10.i386.rpm e28affd61ec6bdc19e136c1355307e90 ghostscript-fonts-cid-6.51-10.i386.rpm 6.3 Installation rpm -Fvh ghostscript-6.51-10.i386.rpm rpm -Fvh ghostscript-doc-6.51-10.i386.rpm rpm -Fvh ghostscript-fonts-6.51-10.i386.rpm rpm -Fvh ghostscript-fonts-cid-6.51-10.i386.rpm 6.4 Source Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS 6.5 Source Packages 2e7ba1c536a23823a9c8072d793258af ghostscript-6.51-10.src.rpm 7. OpenLinux 3.1 Workstation 7.1 Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS 7.2 Packages 53145cdba14975c68766ba720977c5cc ghostscript-6.51-10.i386.rpm d9712806f0f65fba2d806dcc17bd02f6 ghostscript-doc-6.51-10.i386.rpm bbe1c3eea2309a42507c3e0cdab49cf0 ghostscript-fonts-6.51-10.i386.rpm 4eae26e3e44aa27c0c32df3be32bf622 ghostscript-fonts-cid-6.51-10.i386.rpm 7.3 Installation rpm -Fvh ghostscript-6.51-10.i386.rpm rpm -Fvh ghostscript-doc-6.51-10.i386.rpm rpm -Fvh ghostscript-fonts-6.51-10.i386.rpm rpm -Fvh ghostscript-fonts-cid-6.51-10.i386.rpm 7.4 Source Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS 7.5 Source Packages a51ce17775efda0a93f8cf82781f50c5 ghostscript-6.51-10.src.rpm 8. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0363 http://www.ghostscript.com/pipermail/gs-code-review/2002-January/001801.html http://www.ghostscript.com/pipermail/gs-code-review/2002-February/001900.html http://www.redhat.com/support/errata/RHSA-2002-083.html Caldera security resources: http://www.caldera.com/support/security This security fix closes Caldera incidents sr865431, fz521132, erg712067. 9. Disclaimer Caldera International, Inc. is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera products. ______________________________________________________________________________
This archive was generated by hypermail 2b30 : Wed Jun 12 2002 - 05:48:52 PDT