BID:46986

Debian tex-common 'shell_escape_commands' Directive Remote Code Execution Vulnerability

Info

Debian tex-common 'shell_escape_commands' Directive Remote Code Execution Vulnerability

Bugtraq ID:	46986
Class:	Input Validation Error
CVE:	CVE-2011-1400
Remote:	Yes
Local:	No
Published:	Mar 22 2011 12:00AM
Updated:	Apr 04 2011 07:05PM
Credit:	Mathias Svensson
Vulnerable:	Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Debian tex-common 2.08 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0

Not Vulnerable:	Debian tex-common 2.8.1

Discussion

Debian tex-common 'shell_escape_commands' Directive Remote Code Execution Vulnerability

tex-common is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application.

Exploit / POC

Debian tex-common 'shell_escape_commands' Directive Remote Code Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Debian tex-common 'shell_escape_commands' Directive Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.

Ubuntu Ubuntu Linux 10.10 amd64