The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
kpdf Integer Overflows
------------------------------------------------------------------------
SUMMARY
kpdf is a PDF viewer for the KDE environment. Multiple integer overflows
have been found in the product allowing an attacker to cause kpdf to
execute arbitrary code or cause a denial of service against the user
viewing the PDF.
DETAILS
Vulnerable Systems:
* KDE version 3.2.x
* KDE version 3.3.0
* KDE version 3.3.1
Chris Evans notified the KDE security team about multiple integer overflow
and integer arithmetic flaws in xpdf 3.0.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0889>
CAN-2004-0889
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0888>
CAN-2004-0888
These flaws, if exploited, can cause xpdf (and therefore kpdf) to hang
using 100% CPU, crash the viewer or corrupt the program heap. It might be
possible to execute arbitrary code.
kpdf, the KDE pdf viewer, shares code with xpdf 2.02. This code is
significantly different from the xpdf 3.0 codebase, but is also affected
by similar issues. Sebastian Krahmer from the SUSE security team developed
a patch that corrects integer overflows in the XRef code. This patch is
made available below for kpdf as shipped in the KDE 3.2.x releases.
KDE 3.3.1 contains a kpdf based on xpdf 3.0. We're providing a patch to
fix the remaining integer overflows in this code base.
Impact:
Remotely supplied pdf files can be used to execute arbitrary code on the
client machine.
Solution:
Source code patches have been made available which fix these
vulnerabilities. Contact your OS vendor / binary package provider for
information about how to obtain updated binary packages.
Time line and credits:
01/09/2004 KDE Security Team alerted by Chris Evans
08/09/2004 Chris Evans finds similar issues in the xpdf 2.02 codebase
which is used by all released kpdf versions.
24/09/2004 Patch to fix the found issues in xpdf 2.02 developed by
Sebastian Krahmer of SUSE security.
12/10/2004 KDE 3.3.1 release upgrading kpdf to xpdf 3.0 codebase
21/10/2004 Public disclosure
ADDITIONAL INFORMATION
The information has been provided by <mailto:mueller@kde.org> Dirk
Mueller.
The original article can be found at:
<http://www.kde.org/info/security/advisory-20041021-1.txt>
http://www.kde.org/info/security/advisory-20041021-1.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
