Multiple Vendor PDF Hyperlinks Arbitrary Command Execution Vulnerability
BID:7912
Info
Multiple Vendor PDF Hyperlinks Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 7912 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-0434 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 13 2003 12:00AM |
| Updated: | Jul 11 2009 10:06PM |
| Credit: | The discovery of this vulnerability has been credited to Martyn Gilmore <[email protected]>. |
| Vulnerable: |
Yellow Dog Linux 3.0 Xpdf Xpdf 2.0 1 Xpdf Xpdf 2.0 Xpdf Xpdf 1.0 1 Xpdf Xpdf 1.0 0 Xpdf Xpdf 0.93 Xpdf Xpdf 0.92 Turbolinux Turbolinux Workstation 8.0 Turbolinux Turbolinux Workstation 7.0 Turbolinux Turbolinux Server 8.0 Turbolinux Turbolinux Server 7.0 Turbolinux Turbolinux 6.0 Sun Linux 5.0.6 Sun Linux 5.0.5 Sun Linux 5.0.3 Sun Linux 5.0 Redhat Linux Advanced Work Station 2.1 Redhat Linux 9.0 i386 Redhat Linux 8.0 i386 Redhat Linux 7.3 i386 Redhat Linux 7.2 ia64 Redhat Linux 7.2 i386 Redhat Linux 7.1 Redhat Enterprise Linux WS 2.1 IA64 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 2.1 IA64 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux AS 2.1 IA64 Redhat Enterprise Linux AS 2.1 Adobe Acrobat Reader (UNIX) 5.0 6 |
| Not Vulnerable: | |
Discussion
Multiple Vendor PDF Hyperlinks Arbitrary Command Execution Vulnerability
A vulnerability has been reported for multiple PDF viewers for Unix variant operating systems. The problem is said to occur when hyperlinks have been enabled within the viewer. Allegedly, by placing a specially formatted hyperlink within a PDF file it is possible to execute arbitrary shell commands when a user clicks the link. This is due to the PDF viewer invoking an external application, via a call to 'sh -c', to handle the request.
Successful exploitation of this vulnerability could potentially allow an attacker to execute arbitrary commands on a target system with the privileges of the user invoking the PDF document.
It should be noted that this vulnerability may be similar to that described in BID 1624.
** Reports suggest that the fixes supplied by Red Hat and Mandrake Linux do not adequately fix the problem. Specifically, the fixes make changes to xpdf to filter out back quote characters. The problem lies in the fact that other shell metacharacters are not filtered. Thus it may still be possible for attackers to execute arbitrary commands. Red Hat has released updated advisories to correct this oversight.
A vulnerability has been reported for multiple PDF viewers for Unix variant operating systems. The problem is said to occur when hyperlinks have been enabled within the viewer. Allegedly, by placing a specially formatted hyperlink within a PDF file it is possible to execute arbitrary shell commands when a user clicks the link. This is due to the PDF viewer invoking an external application, via a call to 'sh -c', to handle the request.
Successful exploitation of this vulnerability could potentially allow an attacker to execute arbitrary commands on a target system with the privileges of the user invoking the PDF document.
It should be noted that this vulnerability may be similar to that described in BID 1624.
** Reports suggest that the fixes supplied by Red Hat and Mandrake Linux do not adequately fix the problem. Specifically, the fixes make changes to xpdf to filter out back quote characters. The problem lies in the fact that other shell metacharacters are not filtered. Thus it may still be possible for attackers to execute arbitrary commands. Red Hat has released updated advisories to correct this oversight.
Exploit / POC
Multiple Vendor PDF Hyperlinks Arbitrary Command Execution Vulnerability
The following proof of concept was provided by [email protected]:
\documentclass[11pt]{minimal}
\usepackage{color}
\usepackage[urlcolor=blue,colorlinks=true,pdfpagemode=none]{hyperref}
\begin{document}
\href{prot:hyperlink with stuff, say, `rm -rf /tmp/abc`; touch /tmp/pqr}{\textt\t{Click me}}
\end{document}
The source of a sample PDF file has been released which demonstrates this issue.
The following proof of concept was provided by [email protected]:
\documentclass[11pt]{minimal}
\usepackage{color}
\usepackage[urlcolor=blue,colorlinks=true,pdfpagemode=none]{hyperref}
\begin{document}
\href{prot:hyperlink with stuff, say, `rm -rf /tmp/abc`; touch /tmp/pqr}{\textt\t{Click me}}
\end{document}
The source of a sample PDF file has been released which demonstrates this issue.
Solution / Fix
Multiple Vendor PDF Hyperlinks Arbitrary Command Execution Vulnerability
Solution:
Red Hat has released an updated advisory RHSA-2003:196-02 to address this issue. Information regarding obtaining and applying fixes is available in the referenced advisory.
Conectiva has released advisory (CLA-2003:674) to address this issue. Fixes are available below.
Gentoo Linux has released advisory 200306-11 to address this issue. Affected users are advised to issue the following commands to update vulnerable systems:
emerge sync
emerge xpdf
emerge clean
Gentoo Linux has released advisory 200306-12 to address this issue. Affected users are advised to issue the following commands to update vulnerable systems:
emerge sync
emerge acroread
emerge clean
TurboLinux has released an advisory. Affected users are advised to use the turbopkg tool to apply the updates. Further information is available in the referenced advisory.
Mandrake has released an updated advisory (MDKSA-2003:071-1) that addresses this issue. Please see the attached advisory for details on obtaining and applying fixes. The previous Mandrake advisory (MDKSA-2003:071) did not properly address all of these issues.
Sun has released a fix for Sun Linux 5.0.6.
Red Hat has released an updated advisory (RHSA-2003:197-10) that addresses this issue on Enterprise platforms. Please see the attached advisory for further details. These fixes are only available via the Red Hat Network.
Yellow Dog has released an advisory and fixes to address this issue.
The following fixes are available:
Xpdf Xpdf 0.92
Xpdf Xpdf 1.0 1
Xpdf Xpdf 1.0 0
Xpdf Xpdf 2.0 1
Yellow Dog Linux 3.0
Redhat Linux 7.1
Redhat Linux 7.2 i386
Redhat Linux 7.2 ia64
Redhat Linux 7.3 i386
Redhat Linux 8.0 i386
Redhat Linux 9.0 i386
Solution:
Red Hat has released an updated advisory RHSA-2003:196-02 to address this issue. Information regarding obtaining and applying fixes is available in the referenced advisory.
Conectiva has released advisory (CLA-2003:674) to address this issue. Fixes are available below.
Gentoo Linux has released advisory 200306-11 to address this issue. Affected users are advised to issue the following commands to update vulnerable systems:
emerge sync
emerge xpdf
emerge clean
Gentoo Linux has released advisory 200306-12 to address this issue. Affected users are advised to issue the following commands to update vulnerable systems:
emerge sync
emerge acroread
emerge clean
TurboLinux has released an advisory. Affected users are advised to use the turbopkg tool to apply the updates. Further information is available in the referenced advisory.
Mandrake has released an updated advisory (MDKSA-2003:071-1) that addresses this issue. Please see the attached advisory for details on obtaining and applying fixes. The previous Mandrake advisory (MDKSA-2003:071) did not properly address all of these issues.
Sun has released a fix for Sun Linux 5.0.6.
Red Hat has released an updated advisory (RHSA-2003:197-10) that addresses this issue on Enterprise platforms. Please see the attached advisory for further details. These fixes are only available via the Red Hat Network.
Yellow Dog has released an advisory and fixes to address this issue.
The following fixes are available:
Xpdf Xpdf 0.92
-
Sun xpdf-0.92-10.i386.rpm
ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/xpdf-0.92-10.i386.rpm -
Sun xpdf-0.92-9.i386.rpm
ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/xpdf-0.92-9.i386.rpm -
TurboLinux xpdf-0.92-3.i586.rpm
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/upd ates/RPMS/xpdf-0.92-3.i586.rpm -
TurboLinux xpdf-0.92-3.i586.rpm
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/ 7/updates/RPMS/xpdf-0.92-3.i586.rpm
Xpdf Xpdf 1.0 1
-
Mandrake xpdf-1.01-4.3mdk.i586.rpm
Mandrake Linux 9.0 & Corporate Server 2.1
http://www.mandrakesecure.net/en/ftp.php -
Mandrake xpdf-1.01-4.3mdk.x86_64.rpm
Mandrake Corporate Server 2.1/X86_64
http://www.mandrakesecure.net/en/ftp.php
Xpdf Xpdf 1.0 0
-
TurboLinux xpdf-1.00-3.i586.rpm
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/upd ates/RPMS/xpdf-1.00-3.i586.rpm -
TurboLinux xpdf-1.00-3.i586.rpm
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/ 8/updates/RPMS/xpdf-1.00-3.i586.rpm
Xpdf Xpdf 2.0 1
-
Mandrake xpdf-2.01-2.2mdk.i586.rpm
Mandrake Linux 9.1
http://www.mandrakesecure.net/en/ftp.php -
Mandrake xpdf-2.01-2.2mdk.ppc.rpm
Mandrake Linux 9.1/PPC
http://www.mandrakesecure.net/en/ftp.php -
Terra Soft Solutions xpdf-2.01-9.ppc.rpm
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/ppc/x pdf-2.01-9.ppc.rpm -
Terra Soft Solutions xpdf-chinese-simplified-2.01-9.ppc.rpm
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/ppc/x pdf-chinese-simplified-2.01-9.ppc.rpm -
Terra Soft Solutions xpdf-chinese-traditional-2.01-9.ppc.rpm
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/ppc/x pdf-chinese-traditional-2.01-9.ppc.rpm -
Terra Soft Solutions xpdf-japanese-2.01-9.ppc.rpm
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/ppc/x pdf-japanese-2.01-9.ppc.rpm -
Terra Soft Solutions xpdf-korean-2.01-9.ppc.rpm
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/ppc/x pdf-korean-2.01-9.ppc.rpm
Yellow Dog Linux 3.0
-
Yellow Dog xpdf-2.01-11.ppc.rpm
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/ppc/x pdf-2.01-11.ppc.rpm -
Yellow Dog xpdf-chinese-simplified-2.01-11.ppc.rpm
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/ppc/x pdf-chinese-simplified-2.01-11.ppc.rpm -
Yellow Dog xpdf-chinese-traditional-2.01-11.ppc.rpm
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/ppc/x pdf-chinese-traditional-2.01-11.ppc.rpm -
Yellow Dog xpdf-japanese-2.01-11.ppc.rpm
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/ppc/x pdf-japanese-2.01-11.ppc.rpm -
Yellow Dog xpdf-korean-2.01-11.ppc.rpm
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/ppc/x pdf-korean-2.01-11.ppc.rpm
Redhat Linux 7.1
-
RedHat xpdf-0.92-4.71.2.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/xpdf-0.92-4.71.2.i386.rpm
Redhat Linux 7.2 i386
-
RedHat xpdf-0.92-10.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/xpdf-0.92-10.i386.rpm
Redhat Linux 7.2 ia64
-
RedHat xpdf-0.92-10.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/xpdf-0.92-10.ia64.rpm
Redhat Linux 7.3 i386
-
RedHat xpdf-1.00-7.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/xpdf-1.00-7.i386.rpm -
RedHat xpdf-chinese-simplified-1.00-7.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/xpdf-chinese-simplified-1.00-7 .i386.rpm -
RedHat xpdf-chinese-traditional-1.00-7.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/xpdf-chinese-traditional-1.00- 7.i386.rpm -
RedHat xpdf-japanese-1.00-7.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/xpdf-japanese-1.00-7.i386.rpm -
RedHat xpdf-korean-1.00-7.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/xpdf-korean-1.00-7.i386.rpm
Redhat Linux 8.0 i386
-
RedHat xpdf-1.01-12.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/xpdf-1.01-12.i386.rpm -
RedHat xpdf-chinese-simplified-1.01-12.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/xpdf-chinese-simplified-1.01-1 2.i386.rpm -
RedHat xpdf-chinese-simplified-2.01-11.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/xpdf-chinese-simplified-2.01-11. i386.rpm -
RedHat xpdf-chinese-traditional-1.01-12.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/xpdf-chinese-traditional-1.01- 12.i386.rpm -
RedHat xpdf-japanese-1.01-12.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/xpdf-japanese-1.01-12.i386.rpm -
RedHat xpdf-korean-1.01-12.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/xpdf-korean-1.01-12.i386.rpm
Redhat Linux 9.0 i386
-
RedHat xpdf-2.01-11.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/xpdf-2.01-11.i386.rpm -
RedHat xpdf-chinese-traditional-2.01-11.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/xpdf-chinese-traditional-2.01-11 .i386.rpm -
RedHat xpdf-japanese-2.01-11.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/xpdf-japanese-2.01-11.i386.rpm -
RedHat xpdf-korean-2.01-11.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/xpdf-korean-2.01-11.i386.rpm
References
Multiple Vendor PDF Hyperlinks Arbitrary Command Execution Vulnerability
References:
References:
- Adobe Reader Download Page (Adobe)
- RHSA-2003:197-10 Updated Xpdf packages fix security vulnerability (Red Hat)
- Sun Alert ID: 55601 (Sun)
- Sun Linux Support - Sun Linux Patches (Sun)
- Updated xpdf packages are available (Yellow Dog Linux)
- Xpdf Homepage (Xpdf)
- xpdf vulnerability - CAN-2003-0434 ([email protected])