Abrir sesión
logo

DEFENSA FRENTE A LAS CIBERAMENAZAS

barra-separadora

Boletines de Vulnerabilidades


Ejecución de comandos en pstopnm

Clasificación de la vulnerabilidad

Propiedad Valor
Nivel de Confianza Oficial
Impacto Obtener acceso
Dificultad Experto
Requerimientos del atacante Acceso remoto sin cuenta a un servicio exotico

Información sobre el sistema

Propiedad Valor
Fabricante afectado GNU/Linux
Software afectado Netpbm 10.x

Descripción

Se ha descubierto una vulnerabilidad en la aplicación para convertir ficheros PostScript "pstopnm" que pertenece a "netpbm". La vulnerabilidad reside en el tratamiento de la opción "-dSAFER" cuando pstopnm llama a Ghostscript para convertir un fichero PostScript en otro de tipo PBM, PGM, o PNM.

La explotación de esta vulnerabilidad podría permitir a un atacante remoto ejecutar código arbitrario mediante un fichero PostScript especialmente diseñado.

Solución



Actualización de software

SUSE Linux
Actualizar mediante YaST Online Update

Mandriva Linux

Mandrakelinux 10.0
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/libnetpbm9-9.24-8.2.100mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/libnetpbm9-devel-9.24-8.2.100mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/libnetpbm9-static-devel-9.24-8.2.100mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/netpbm-9.24-8.2.100mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/SRPMS/netpbm-9.24-8.2.100mdk.src.rpm
AMD64
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/lib64netpbm9-9.24-8.2.100mdk.amd64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/lib64netpbm9-devel-9.24-8.2.100mdk.amd64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/lib64netpbm9-static-devel-9.24-8.2.100mdk.amd64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/netpbm-9.24-8.2.100mdk.amd64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/SRPMS/netpbm-9.24-8.2.100mdk.src.rpm

Mandrakelinux 10.1
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/libnetpbm9-9.24-8.1.101mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/libnetpbm9-devel-9.24-8.1.101mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/libnetpbm9-static-devel-9.24-8.1.101mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/netpbm-9.24-8.1.101mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/SRPMS/netpbm-9.24-8.1.101mdk.src.rpm
X86_64
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/lib64netpbm9-9.24-8.1.101mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/lib64netpbm9-devel-9.24-8.1.101mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/lib64netpbm9-static-devel-9.24-8.1.101mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/netpbm-9.24-8.1.101mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/SRPMS/netpbm-9.24-8.1.101mdk.src.rpm

Corporate Server 2.1
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/libnetpbm9-9.24-4.4.C21mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/libnetpbm9-devel-9.24-4.4.C21mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/libnetpbm9-static-devel-9.24-4.4.C21mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/netpbm-9.24-4.4.C21mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/SRPMS/netpbm-9.24-4.4.C21mdk.src.rpm
X86_64
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/libnetpbm9-9.24-4.4.C21mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/libnetpbm9-devel-9.24-4.4.C21mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/libnetpbm9-static-devel-9.24-4.4.C21mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/netpbm-9.24-4.4.C21mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/SRPMS/netpbm-9.24-4.4.C21mdk.src.rpm

Corporate Server 3.0
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/libnetpbm9-9.24-8.2.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/libnetpbm9-devel-9.24-8.2.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/libnetpbm9-static-devel-9.24-8.2.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/netpbm-9.24-8.2.C30mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/SRPMS/netpbm-9.24-8.2.C30mdk.src.rpm
X86_64
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/lib64netpbm9-9.24-8.2.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/lib64netpbm9-devel-9.24-8.2.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/lib64netpbm9-static-devel-9.24-8.2.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/netpbm-9.24-8.2.C30mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/SRPMS/netpbm-9.24-8.2.C30mdk.src.rpm

Mandrivalinux LE2005
X86
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/libnetpbm10-10.26-2.1.102mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/libnetpbm10-devel-10.26-2.1.102mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/libnetpbm10-static-devel-10.26-2.1.102mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/netpbm-10.26-2.1.102mdk.i586.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/SRPMS/netpbm-10.26-2.1.102mdk.src.rpm
X86_64
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/lib64netpbm10-10.26-2.1.102mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/lib64netpbm10-devel-10.26-2.1.102mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/lib64netpbm10-static-devel-10.26-2.1.102mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/netpbm-10.26-2.1.102mdk.x86_64.rpm
ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/SRPMS/netpbm-10.26-2.1.102mdk.src.rpm

Red Hat Linux

Red Hat Desktop (v. 3) / SRPMS
netpbm-9.24-11.30.2.src.rpm t

Red Hat Desktop (v. 3) / IA-32
netpbm-9.24-11.30.2.i386.rpm t
netpbm-devel-9.24-11.30.2.i386.rpm
netpbm-progs-9.24-11.30.2.i386.rpm

Red Hat Desktop (v. 3) / x86_64
netpbm-9.24-11.30.2.i386.rpm t
netpbm-9.24-11.30.2.x86_64.rpm t
netpbm-devel-9.24-11.30.2.x86_64.rpm t
netpbm-progs-9.24-11.30.2.x86_64.rpm t

Red Hat Desktop (v. 4) / SRPMS
netpbm-10.25-2.EL4.1.src.rpm t
Red Hat Desktop (v. 4) / IA-32
netpbm-10.25-2.EL4.1.i386.rpm t
netpbm-devel-10.25-2.EL4.1.i386.rpm
netpbm-progs-10.25-2.EL4.1.i386.rpm
Red Hat Desktop (v. 4) / x86_64
netpbm-10.25-2.EL4.1.i386.rpm t
netpbm-10.25-2.EL4.1.x86_64.rpm t
netpbm-devel-10.25-2.EL4.1.x86_64.rpm t
netpbm-progs-10.25-2.EL4.1.x86_64.rpm t

Red Hat Enterprise Linux AS (v. 2.1) / SRPMS
netpbm-9.24-9.AS21.4.src.rpm t

Red Hat Enterprise Linux AS (v. 2.1) / IA-32
netpbm-9.24-9.AS21.4.i386.rpm t
netpbm-devel-9.24-9.AS21.4.i386.rpm t
netpbm-progs-9.24-9.AS21.4.i386.rpm t

Red Hat Enterprise Linux AS (v. 2.1) / IA-64
netpbm-9.24-9.AS21.4.ia64.rpm t
netpbm-devel-9.24-9.AS21.4.ia64.rpm t
netpbm-progs-9.24-9.AS21.4.ia64.rpm t

Red Hat Enterprise Linux AS (v. 3) / SRPMS
netpbm-9.24-11.30.2.src.rpm t

Red Hat Enterprise Linux AS (v. 3) / IA-32
netpbm-9.24-11.30.2.i386.rpm t
netpbm-devel-9.24-11.30.2.i386.rpm t
netpbm-progs-9.24-11.30.2.i386.rpm t

Red Hat Enterprise Linux AS (v. 3) / IA-64
netpbm-9.24-11.30.2.i386.rpm t
netpbm-9.24-11.30.2.ia64.rpm t
netpbm-devel-9.24-11.30.2.ia64.rpm t
netpbm-progs-9.24-11.30.2.ia64.rpm t

Red Hat Enterprise Linux AS (v. 3) / PPC
netpbm-9.24-11.30.2.ppc.rpm t
netpbm-9.24-11.30.2.ppc64.rpm t
netpbm-devel-9.24-11.30.2.ppc.rpm
netpbm-progs-9.24-11.30.2.ppc.rpm

Red Hat Enterprise Linux AS (v. 3) / s390
netpbm-9.24-11.30.2.s390.rpm t
netpbm-devel-9.24-11.30.2.s390.rpm
netpbm-progs-9.24-11.30.2.s390.rpm

Red Hat Enterprise Linux AS (v. 3) / s390x
netpbm-9.24-11.30.2.s390.rpm t
netpbm-9.24-11.30.2.s390x.rpm t
netpbm-devel-9.24-11.30.2.s390x.rpm t
netpbm-progs-9.24-11.30.2.s390x.rpm t

Red Hat Enterprise Linux AS (v. 3) / x86_64
netpbm-9.24-11.30.2.i386.rpm t
netpbm-9.24-11.30.2.x86_64.rpm t
netpbm-devel-9.24-11.30.2.x86_64.rpm t
netpbm-progs-9.24-11.30.2.x86_64.rpm t

Red Hat Enterprise Linux AS (v. 4) / SRPMS
netpbm-10.25-2.EL4.1.src.rpm t

Red Hat Enterprise Linux AS (v. 4) / IA-32
netpbm-10.25-2.EL4.1.i386.rpm t
netpbm-devel-10.25-2.EL4.1.i386.rpm t
netpbm-progs-10.25-2.EL4.1.i386.rpm t

Red Hat Enterprise Linux AS (v. 4) / IA-64
netpbm-10.25-2.EL4.1.i386.rpm t
netpbm-10.25-2.EL4.1.ia64.rpm t
netpbm-devel-10.25-2.EL4.1.ia64.rpm
netpbm-progs-10.25-2.EL4.1.ia64.rpm

Red Hat Enterprise Linux AS (v. 4) / PPC
netpbm-10.25-2.EL4.1.ppc.rpm t
netpbm-10.25-2.EL4.1.ppc64.rpm t
netpbm-devel-10.25-2.EL4.1.ppc.rpm t
netpbm-progs-10.25-2.EL4.1.ppc.rpm t

Red Hat Enterprise Linux AS (v. 4) / s390
netpbm-10.25-2.EL4.1.s390.rpm t
netpbm-devel-10.25-2.EL4.1.s390.rpm t
netpbm-progs-10.25-2.EL4.1.s390.rpm t

Red Hat Enterprise Linux AS (v. 4) / s390x
netpbm-10.25-2.EL4.1.s390.rpm t
netpbm-10.25-2.EL4.1.s390x.rpm t
netpbm-devel-10.25-2.EL4.1.s390x.rpm
netpbm-progs-10.25-2.EL4.1.s390x.rpm

Red Hat Enterprise Linux AS (v. 4) / x86_64
netpbm-10.25-2.EL4.1.i386.rpm t
netpbm-10.25-2.EL4.1.x86_64.rpm t
netpbm-devel-10.25-2.EL4.1.x86_64.rpm t
netpbm-progs-10.25-2.EL4.1.x86_64.rpm t

Red Hat Enterprise Linux ES (v. 2.1) / SRPMS
netpbm-9.24-9.AS21.4.src.rpm t

Red Hat Enterprise Linux ES (v. 2.1) / IA-32
netpbm-9.24-9.AS21.4.i386.rpm t
netpbm-devel-9.24-9.AS21.4.i386.rpm t
netpbm-progs-9.24-9.AS21.4.i386.rpm t

Red Hat Enterprise Linux ES (v. 3) / SRPMS
netpbm-9.24-11.30.2.src.rpm t

Red Hat Enterprise Linux ES (v. 3) / IA-32
netpbm-9.24-11.30.2.i386.rpm t
netpbm-devel-9.24-11.30.2.i386.rpm
netpbm-progs-9.24-11.30.2.i386.rpm

Red Hat Enterprise Linux ES (v. 3) / IA-64
netpbm-9.24-11.30.2.i386.rpm t
netpbm-9.24-11.30.2.ia64.rpm t
netpbm-devel-9.24-11.30.2.ia64.rpm
netpbm-progs-9.24-11.30.2.ia64.rpm

Red Hat Enterprise Linux ES (v. 3) / x86_64
netpbm-9.24-11.30.2.i386.rpm t
netpbm-9.24-11.30.2.x86_64.rpm t
netpbm-devel-9.24-11.30.2.x86_64.rpm t
netpbm-progs-9.24-11.30.2.x86_64.rpm t

Red Hat Enterprise Linux ES (v. 4) / SRPMS
netpbm-10.25-2.EL4.1.src.rpm t

Red Hat Enterprise Linux ES (v. 4) / IA-32
netpbm-10.25-2.EL4.1.i386.rpm t
netpbm-devel-10.25-2.EL4.1.i386.rpm
netpbm-progs-10.25-2.EL4.1.i386.rpm

Red Hat Enterprise Linux ES (v. 4) / IA-64
netpbm-10.25-2.EL4.1.i386.rpm t
netpbm-10.25-2.EL4.1.ia64.rpm t
netpbm-devel-10.25-2.EL4.1.ia64.rpm
netpbm-progs-10.25-2.EL4.1.ia64.rpm

Red Hat Enterprise Linux ES (v. 4) / x86_64
netpbm-10.25-2.EL4.1.i386.rpm t
netpbm-10.25-2.EL4.1.x86_64.rpm t
netpbm-devel-10.25-2.EL4.1.x86_64.rpm t
netpbm-progs-10.25-2.EL4.1.x86_64.rpm t

Red Hat Enterprise Linux WS (v. 2.1) / SRPMS
netpbm-9.24-9.AS21.4.src.rpm t

Red Hat Enterprise Linux WS (v. 2.1) / IA-32
netpbm-9.24-9.AS21.4.i386.rpm t
netpbm-devel-9.24-9.AS21.4.i386.rpm t
netpbm-progs-9.24-9.AS21.4.i386.rpm t

Red Hat Enterprise Linux WS (v. 3) / SRPMS
netpbm-9.24-11.30.2.src.rpm t

Red Hat Enterprise Linux WS (v. 3) / IA-32
netpbm-9.24-11.30.2.i386.rpm t
netpbm-devel-9.24-11.30.2.i386.rpm
netpbm-progs-9.24-11.30.2.i386.rpm

Red Hat Enterprise Linux WS (v. 3) / IA-64
netpbm-9.24-11.30.2.i386.rpm t
netpbm-9.24-11.30.2.ia64.rpm t
netpbm-devel-9.24-11.30.2.ia64.rpm
netpbm-progs-9.24-11.30.2.ia64.rpm

Red Hat Enterprise Linux WS (v. 3) / x86_64
netpbm-9.24-11.30.2.i386.rpm t
netpbm-9.24-11.30.2.x86_64.rpm t
netpbm-devel-9.24-11.30.2.x86_64.rpm t
netpbm-progs-9.24-11.30.2.x86_64.rpm t

Red Hat Enterprise Linux WS (v. 4) / SRPMS
netpbm-10.25-2.EL4.1.src.rpm t

Red Hat Enterprise Linux WS (v. 4) / IA-32
netpbm-10.25-2.EL4.1.i386.rpm t
netpbm-devel-10.25-2.EL4.1.i386.rpm
netpbm-progs-10.25-2.EL4.1.i386.rpm

Red Hat Enterprise Linux WS (v. 4) / IA-64
netpbm-10.25-2.EL4.1.i386.rpm t
netpbm-10.25-2.EL4.1.ia64.rpm t
netpbm-devel-10.25-2.EL4.1.ia64.rpm
netpbm-progs-10.25-2.EL4.1.ia64.rpm

Red Hat Enterprise Linux WS (v. 4) / x86_64
netpbm-10.25-2.EL4.1.i386.rpm t
netpbm-10.25-2.EL4.1.x86_64.rpm t
netpbm-devel-10.25-2.EL4.1.x86_64.rpm t
netpbm-progs-10.25-2.EL4.1.x86_64.rpm t

Red Hat Linux Advanced Workstation 2.1 Itanium Processor / SRPMS
netpbm-9.24-9.AS21.4.src.rpm t

Red Hat Linux Advanced Workstation 2.1 Itanium Processor / IA-64
netpbm-9.24-9.AS21.4.ia64.rpm t
netpbm-devel-9.24-9.AS21.4.ia64.rpm t
netpbm-progs-9.24-9.AS21.4.ia64.rpm

SGI
SGI ProPack 3 Service Pack 6 Parche 10212
http://support.sgi.com/

Identificadores estándar

Propiedad Valor
CVE CAN-2005-2471
BID NULL

Recursos adicionales

SUSE Security Summary Report SUSE-SR:2005:019
http://www.novell.com/linux/security/advisories/2005_19_sr.html

Mandriva Security Advisories MDKSA-2005:133
http://www.mandriva.com/security/advisories?name=MDKSA-2005:133

Red Hat Security Advisory RHSA-2005:743-08
https://rhn.redhat.com/errata/RHSA-2005-743.html

SGI Security advisory (20050901-01-U)
ftp://patches.sgi.com/support/free/security/advisories/20050901-01-U.asc

Histórico de versiones

Versión Comentario Fecha
1.0 Aviso emitido 2005-08-29
1.1 Aviso emitido por Red Hat (RHSA-2005:743-08) 2005-08-31
1.2 Aviso emitido por SGI (20050901-01-U) 2005-09-16
Volver

Este sitio web utiliza cookies propias y de terceros para el correcto funcionamiento y visualización del sitio web por parte del usuario, así como la recogida de estadísticas. Si continúa navegando, consideramos que acepta su uso. Puede cambiar la configuración u obtener más información. Modificar configuración