KDE KPDF/KWord/XPDF StreamPredictor Function Stack Buffer Overflow Vulnerability

Bugtraq ID:	25124
Class:	Boundary Condition Error
CVE:	CVE-2007-3387
Remote:	Yes
Local:	No
Published:	Jul 30 2007 12:00AM
Updated:	May 13 2008 01:25AM
Credit:	Derek Noonburg is credited with the discovery of this vulnerability.
Vulnerable:	Xpdf Xpdf 3.0 pl3 Xpdf Xpdf 3.0 pl2 Xpdf Xpdf 3.0 1pl1 Xpdf Xpdf 3.0 1 Xpdf Xpdf 3.0 0 Xpdf Xpdf 2.0.3 Xpdf Xpdf 2.0.2 pl1 Xpdf Xpdf 2.0.2 Xpdf Xpdf 2.0.1 Xpdf Xpdf 2.0 3 Xpdf Xpdf 2.0 2 + Red Hat Enterprise Linux AS 3 + Red Hat Enterprise Linux AS 3 + Red Hat Enterprise Linux AS 3 + RedHat Desktop 3.0 + RedHat Enterprise Linux ES 3 + RedHat Enterprise Linux ES 3 + RedHat Enterprise Linux ES 3 + RedHat Enterprise Linux WS 3 + RedHat Enterprise Linux WS 3 + RedHat Enterprise Linux WS 3 Xpdf Xpdf 2.0 1 Xpdf Xpdf 2.0 Xpdf Xpdf 1.0 1 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.2 + Gentoo Linux 1.2 + Gentoo Linux 1.2 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Corporate Server 2.1 + Mandriva Linux Mandrake 9.0 + Mandriva Linux Mandrake 9.0 + Mandriva Linux Mandrake 9.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.2 Xpdf Xpdf 1.0 0a Xpdf Xpdf 1.0 0 Xpdf Xpdf 3.01 + Debian Linux 4.0 sparc + Debian Linux 4.0 s/390 + Debian Linux 4.0 powerpc + Debian Linux 4.0 mipsel + Debian Linux 4.0 mips + Debian Linux 4.0 m68k + Debian Linux 4.0 ia-64 + Debian Linux 4.0 ia-32 + Debian Linux 4.0 hppa + Debian Linux 4.0 arm + Debian Linux 4.0 amd64 + Debian Linux 4.0 alpha + Debian Linux 4.0 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 + Mandriva Linux Mandrake 10.1 + Mandriva Linux Mandrake 10.1 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 10.0 + Red Hat Fedora Core3 + Red Hat Fedora Core2 + Red Hat Fedora Core2 + Red Hat Fedora Core2 + Turbolinux Turbolinux Server 10.0 + Turbolinux Turbolinux Server 10.0 + Turbolinux Turbolinux Server 10.0 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 + Ubuntu Ubuntu Linux 4.1 ia32 + Ubuntu Ubuntu Linux 4.1 ia32 Xpdf Xpdf 3.0.1 (Patch 2) Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Turbolinux Turbolinux Server 10.0 x86 Turbolinux Turbolinux Server 10.0 Turbolinux Turbolinux Server 10.0.0 x64 Turbolinux Turbolinux Desktop 10.0 Turbolinux Turbolinux FUJI Turbolinux Turbolinux 10 F... TurboLinux Personal TurboLinux Multimedia Turbolinux Home Turbolinux FUJI 0 Turbolinux Appliance Server Workgroup Edition 1.0 Turbolinux Appliance Server Hosting Edition 1.0 Turbolinux Appliance Server 1.0 Workgroup Edition Turbolinux Appliance Server 1.0 Hosting Edition Turbolinux Appliance Server 2.0 TransSoft Broker FTP Server 8.0 teTeX teTeX 3.0 teTeX teTeX 2.0.2 teTeX teTeX 2.0.1 teTeX teTeX 2.0 teTeX teTeX 1.0.7 teTeX teTeX 1.0.6 SuSE SUSE Linux Enterprise Server 9 SP3 SuSE SUSE Linux Enterprise Server 8 SuSE SUSE Linux Enterprise Server 7 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise SDK 9 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE SUSE Linux Enterprise SDK 10 SuSE SUSE Linux Enterprise SDK 10 SuSE SUSE Linux Enterprise Desktop 10 SP1 SuSE SUSE Linux Enterprise Desktop 10 SuSE Linux Professional 10.2 x86_64 SuSE Linux Personal 10.2 x86_64 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 12.0 Slackware Linux 11.0 SGI Advanced Linux Environment 3.0 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. SuSE Linux Open-Xchange 4.1 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Office Server S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Novell Linux Desktop 9 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 9.0 x86_64 S.u.S.E. Linux Professional 9.0 S.u.S.E. Linux Professional 8.2 S.u.S.E. Linux Professional 8.2 S.u.S.E. Linux Professional 7.3 S.u.S.E. Linux Professional 10.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 9.0 S.u.S.E. Linux Personal 8.2 S.u.S.E. Linux Personal 10.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Openexchange Server S.u.S.E. Linux Office Server S.u.S.E. Linux Enterprise Server for S/390 9.0 S.u.S.E. Linux Enterprise Server for S/390 S.u.S.E. Linux Enterprise Server 9-SP3 S.u.S.E. Linux Enterprise Server 9 S.u.S.E. Linux Enterprise Server 10.SP1 S.u.S.E. Linux Enterprise Server 10 S.u.S.E. Linux Desktop 1.0 S.u.S.E. Linux Desktop 10 S.u.S.E. Linux 8.1 S.u.S.E. Linux 8.0 S.u.S.E. Linux 7.3 S.u.S.E. Linux 7.2 S.u.S.E. Linux 7.1 S.u.S.E. Linux 7.0 S.u.S.E. Linux 6.4 S.u.S.E. Linux 6.3 S.u.S.E. Linux 6.2 S.u.S.E. Linux 6.1 S.u.S.E. Linux 6.0 S.u.S.E. Linux 5.3 S.u.S.E. Linux 5.2 S.u.S.E. Linux 5.1 S.u.S.E. Linux 5.0 S.u.S.E. Linux 4.4.1 S.u.S.E. Linux 4.4 S.u.S.E. Linux 4.3 S.u.S.E. Linux 4.2 S.u.S.E. Linux 4.0 S.u.S.E. Linux 3.0 S.u.S.E. Linux 2.0 S.u.S.E. Linux 1.0 S.u.S.E. Linux 9.3 x86-64 S.u.S.E. Linux 9.3 x86 S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc S.u.S.E. Linux 10.0 x86-64 S.u.S.E. Linux 10.0 x86 S.u.S.E. Linux 10.0 ppc rPath rPath Linux 1 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux WS 2.1 IA64 RedHat Enterprise Linux WS 2.1 RedHat Enterprise Linux Optional Productivity Application 5 server RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux ES 2.1 IA64 RedHat Enterprise Linux ES 2.1 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Desktop 4.0 RedHat Desktop 3.0 Red Hat Fedora Core7 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 Red Hat Enterprise Linux AS 2.1 IA64 Red Hat Enterprise Linux AS 2.1 Red Hat Enterprise Linux 5 Server pTeX pTeX 3.1.10 Poppler poppler 0.5.4 Poppler poppler 0.5.3 Poppler poppler 0.5.1 Poppler poppler 0.4.5 Poppler poppler 0.4.2 Poppler poppler 0.4.1 Poppler poppler 0.3.2 PDFedit PDFedit 0.3.1 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 KDE kword 1.5.2 KDE kword 1.5 KDE kword 1.4.2 KDE kword 1.4.1 KDE KOffice 1.6.1 KDE KOffice 1.6 KDE KOffice 1.5.91 KDE KOffice 1.5.2 KDE KOffice 1.5 KDE KOffice 1.4.2 KDE KOffice 1.4.1 KDE KOffice 1.4 KDE KOffice 1.3.5 KDE KOffice 1.3.4 KDE KOffice 1.3.3 KDE KOffice 1.3.2 KDE KOffice 1.3.1 KDE KOffice 1.3 beta3 KDE KOffice 1.3 beta2 KDE KOffice 1.3 beta1 KDE KOffice 1.3 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 KDE KOffice 1.2.92 KDE KOffice 1.2.1 KDE KOffice 1.2 KDE kdegraphics 3.5.4 KDE KDE 3.5.7 KDE KDE 3.5.6 KDE KDE 3.5.5 KDE KDE 3.5.4 KDE KDE 3.5.3 KDE KDE 3.5.2 KDE KDE 3.5.1 KDE KDE 3.5 KDE KDE 3.4.3 KDE KDE 3.4.2 KDE KDE 3.4.1 KDE KDE 3.4 KDE KDE 3.4 KDE KDE 3.3.2 KDE KDE 3.3.2 KDE KDE 3.3.1 KDE KDE 3.3 KDE KDE 3.2.3 KDE KDE 3.2.2 KDE KDE 3.2.1 KDE KDE 3.2 GNUstep Gnustep 0 GNU libextractor 0.4.2 GNOME GPdf 2.8.3 GNOME GPdf 2.8.2 + Red Hat Fedora Core3 + Red Hat Fedora Core2 GNOME GPdf 2.8 GNOME GPdf 2.1 Gentoo Linux Foresight Linux Foresight Linux 1.1 Easy Software Products CUPS 1.2.10 Easy Software Products CUPS 1.2.9 Easy Software Products CUPS 1.1.23 rc1 Easy Software Products CUPS 1.1.23 Easy Software Products CUPS 1.1.22 rc1 Easy Software Products CUPS 1.1.22 Easy Software Products CUPS 1.1.21 Easy Software Products CUPS 1.1.20 Easy Software Products CUPS 1.1.19 rc5 Easy Software Products CUPS 1.1.19 Easy Software Products CUPS 1.1.18 Easy Software Products CUPS 1.1.17 Easy Software Products CUPS 1.1.16 Easy Software Products CUPS 1.1.15 Easy Software Products CUPS 1.1.14 Easy Software Products CUPS 1.1.13 Easy Software Products CUPS 1.1.12 + S.u.S.E. Linux 8.0 i386 + S.u.S.E. Linux 8.0 Easy Software Products CUPS 1.1.10 Easy Software Products CUPS 1.1.7 Easy Software Products CUPS 1.1.6 Easy Software Products CUPS 1.1.4 -5 Easy Software Products CUPS 1.1.4 -3 + Mandriva Linux Mandrake 7.2 Easy Software Products CUPS 1.1.4 -2 + Debian Linux 2.3 Easy Software Products CUPS 1.1.4 Easy Software Products CUPS 1.1.1 + RedHat PowerTools 7.0 Easy Software Products CUPS 1.0.4 -8 Easy Software Products CUPS 1.0.4 DrPhibez and Nitro187 Guild FTPD 1.1.19 rc5 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 CSTeX cstetex 2.0.2 Avaya Messaging Storage Server MSS 3.0 Avaya Messaging Storage Server MM3.0 Avaya Messaging Storage Server 2.0 Avaya Messaging Storage Server 1.0 Avaya Messaging Storage Server Avaya Message Networking MN 3.1 Avaya Message Networking Avaya Intuity LX 2.0 Avaya Intuity LX Avaya Communication Manager 2.0 Avaya Communication Manager 3.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 + Avaya Communication Manager Server S8700 Avaya Communication Manager 2.2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Communication Manager 2.1 Avaya Aura Application Enablement Services 3.1.4
Not Vulnerable:	PDFedit PDFedit 0.3.2

KDE KPDF/KWord/XPDF StreamPredictor Function Stack Buffer Overflow Vulnerability

KDE kpdf, kword, and xpdf are prone to a stack-based buffer-overflow vulnerability because the applications fail to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application or cause the affected application to crash, denying service to legitimate users.

KDE KPDF/KWord/XPDF StreamPredictor Function Stack Buffer Overflow Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

KDE KPDF/KWord/XPDF StreamPredictor Function Stack Buffer Overflow Vulnerability

Solution:
The vendor released patches to address this issue. Please see the references for more information.


Turbolinux Turbolinux 10 F...

• Turbolinux cups-1.1.20-17.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/u pdates/RPMS/cups-1.1.20-17.i586.rpm


• Turbolinux cups-devel-1.1.20-17.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/u pdates/RPMS/cups-devel-1.1.20-17.i586.rpm


• Turbolinux cups-libs-1.1.20-17.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/u pdates/RPMS/cups-libs-1.1.20-17.i586.rpm

KDE KOffice 1.3

• Cuyahoga koffice-xpdf-CVE-2007-3387.diff
  ftp://ftp.kde.org/pub/kde/security_patches/koffice-xpdf-CVE-2007-3387. diff

KDE KOffice 1.5

• Cuyahoga koffice-xpdf-CVE-2007-3387.diff
  ftp://ftp.kde.org/pub/kde/security_patches/koffice-xpdf-CVE-2007-3387. diff

KDE KOffice 1.5.2

• Cuyahoga koffice-xpdf-CVE-2007-3387.diff
  ftp://ftp.kde.org/pub/kde/security_patches/koffice-xpdf-CVE-2007-3387. diff

KDE KOffice 1.6.1

• Cuyahoga koffice-xpdf-CVE-2007-3387.diff
  ftp://ftp.kde.org/pub/kde/security_patches/koffice-xpdf-CVE-2007-3387. diff

KDE KDE 3.5.3

• Cuyahoga post-3.5.7-kdegraphics-CVE-2007-3387.diff
  ftp://ftp.kde.org/pub/kde/security_patches/post-3.5.7-kdegraphics-CVE- 2007-3387.diff

KDE KDE 3.5.6

• Cuyahoga post-3.5.7-kdegraphics-CVE-2007-3387.diff
  ftp://ftp.kde.org/pub/kde/security_patches/post-3.5.7-kdegraphics-CVE- 2007-3387.diff

KDE KPDF/KWord/XPDF StreamPredictor Function Stack Buffer Overflow Vulnerability

References:

• KOffice Product Page (KDE)
  
• KPDf Home Page (KDE)
  
• PDFedit Release Notes 0.3.2 (PDFedit)
  
• Xpdf Homepage (Xpdf)
  
• ASA-2007-401 cups security update (RHSA-2007-0720) (Avaya)
  
• kpdf/kword/xpdf stack based buffer overflow (KDE)
  
• RHSA-2007:0720-3 Important: cups security update (Red Hat)
  
• RHSA-2007:0729-2 Important: kdegraphics security update (Red Hat)
  
• RHSA-2007:0730-2 Important: gpdf security update (Red Hat)
  
• RHSA-2007:0731-3 Important: tetex security update (Red Hat)
  
• RHSA-2007:0732-2 Important: poppler security update (Red Hat)
  
• RHSA-2007:0735-2 Important: xpdf security update (Red Hat)
  
• SUSE-SR:2007:016 (Novell)