| Summary: | html2ps - arbitrary file disclosure in SSI directives (CVE-2009-5067) | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Oden Eriksson <oe> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | major | ||
| Priority: | Normal | CC: | davidwhodgins, luigiwalser, sysadmin-bugs, tmb, wassi |
| Version: | 2 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/389349/ | ||
| Whiteboard: | MGA1TOO has_procedure mga1-32-OK mga1-64-OK mga2-64-OK MGA2-32-OK | ||
| Source RPM: | html2ps-2.0-2.b5.5.mga1.src.rpm | CVE: | |
| Status comment: | |||
|
Description
Oden Eriksson
2012-10-06 09:00:59 CEST
This was assigned CVE-2009-5067 as of: http://www.openwall.com/lists/oss-security/2012/10/05/5 This was fixed in cauldron with html2ps-2.0-2.b7.1.mga3.src.rpm Correct patch can be found in RHEL6 updates. Mandriva has issued an advisory for this today (October 6): http://www.mandriva.com/en/support/security/advisories/?dis=2011&name=MDVSA-2012:161 CC:
(none) =>
luigiwalser
David Walser
2012-10-09 13:06:48 CEST
URL:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5067 =>
http://lwn.net/Vulnerabilities/389349/ Updated packages uploaded for Mageia 1 and Mageia 2. Advisory: ======================== Updated html2ps packages fix security vulnerability: Directory traversal vulnerability in html2ps before 1.0b7 allows remote attackers to read arbitrary files via directory traversal sequences in SSI directives (CVE-2009-5067). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5067 http://www.mandriva.com/en/support/security/advisories/?dis=2011&name=MDVSA-2012:161 ======================== Updated packages in core/updates_testing: ======================== html2ps-2.0-2.b7.1.mga1 xhtml2ps-2.0-2.b7.1.mga1 html2ps-2.0-2.b7.1.mga2 xhtml2ps-2.0-2.b7.1.mga2 from SRPMS: html2ps-2.0-2.b7.1.mga1.src.rpm html2ps-2.0-2.b7.1.mga2.src.rpm Assignee:
bugsquad =>
qa-bugs Testing using the PoC linked in comment 0 http://www.packetstormsecurity.org/0909-exploits/html2ps-disclose.txt Installed gv then.. $ python html2ps-disclose.txt Displays the contents of /etc/passwd After update, just displays two 'Epiphant' Testing complete Mageia 2 x86_64
claire robinson
2012-10-11 16:29:09 CEST
Whiteboard:
MGA1TOO =>
MGA1TOO mga2-64-OK
claire robinson
2012-10-11 18:20:21 CEST
Whiteboard:
MGA1TOO mga2-64-OK =>
MGA1TOO has_procedure mga2-64-OK Tested on MGA2, i586, using the procedure from Comment 4. Thanks Claire! Note to fellow testers: gv is also a Mageia package, not a python egg... :) I could reproduce the bug, the update fixes the issue. However, for some reason gv shows an empty file after installing the updated package - but Okular is able to open the file and shows "Epiphant" two times, but not the password. This looks like a regression to me, but since okular can still open the file I'm not sure this should prevent us from pushing this security update. However, it might be easy to fix - what do you think? SRPM: html2ps-2.0-2.b7.1.mga2.src.rpm CC:
(none) =>
wassi Testing complete mga1 32 Whiteboard:
MGA1TOO has_procedure mga2-64-OK =>
MGA1TOO has_procedure mga1-32-OK mga2-64-OK Testing complete mga1 64 Whiteboard:
MGA1TOO has_procedure mga1-32-OK mga2-64-OK =>
MGA1TOO has_procedure mga1-32-OK mga1-64-OK mga2-64-OK Testing complete Mageia 2 x86-64, and Mageia 2 i586. Could someone from the sysadmin team push the srpm html2ps-2.0-2.b7.1.mga2.src.rpm from Mageia 2 Core Updates Testing to Core Updates and the srpm html2ps-2.0-2.b7.1.mga1.src.rpm from Mageia 1 Core Updates Testing to Core Updates. Advisory: Updated html2ps packages fix security vulnerability: Directory traversal vulnerability in html2ps before 1.0b7 allows remote attackers to read arbitrary files via directory traversal sequences in SSI directives (CVE-2009-5067). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5067 http://www.mandriva.com/en/support/security/advisories/?dis=2011&name=MDVSA-2012:161 https://bugs.mageia.org/show_bug.cgi?id=7722 Keywords:
(none) =>
validated_update Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0297 Status:
NEW =>
RESOLVED |