Executive Summary
Summary | |
---|---|
Title | ghostscript security update |
Informations | |||
---|---|---|---|
Name | RHSA-2005:081 | First vendor Publication | 2005-09-28 |
Vendor | RedHat | Last vendor Modification | 2005-09-28 |
Severity (Vendor) | Low | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 7.2 | Attack Range | Local |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 3.9 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated ghostscript packages that fix a PDF output issue and a temporary file security bug are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Problem description: Ghostscript is a program for displaying PostScript files or printing them to non-PostScript printers. A bug was found in the way several of Ghostscript's utility scripts created temporary files. A local user could cause these utilities to overwrite files that the victim running the utility has write access to. The Common Vulnerabilities and Exposures project assigned the name CAN-2004-0967 to this issue. Additionally, this update addresses the following issue: A problem has been identified in the PDF output driver, which can cause output to be delayed indefinitely on some systems. The fix has been backported from GhostScript 7.07. All users of ghostscript should upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ 5. Bug IDs fixed (http://bugzilla.redhat.com/): 97583 - [7.05-20.1] gs gets stuck reading /dev/random 136321 - CAN-2004-0967 temporary file vulnerabilities in various ghostscript scripts. |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2005-081.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10284 | |||
Oval ID: | oval:org.mitre.oval:def:10284 | ||
Title: | The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files. | ||
Description: | The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2004-0967 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2008-09-24 | Name : Gentoo Security Advisory GLSA 200410-18 (Ghostscript) File : nvt/glsa_200410_18.nasl |
2008-09-04 | Name : FreeBSD Ports: ghostscript-gnu, ghostscript-gnu-nox11 File : nvt/freebsd_ghostscript-gnu.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
13196 | Juniper Junos Unspecified Packet Processing Remote DoS |
11069 | Ghostscript Multiple Scripts Symlink Arbitrary File Overwrite Ghostscript contains a flaw that may allow a malicious user to overwrite arbitrary files. The issue is due to multiple scripts creating temporary files with predictable names in world-writeable directories. It is possible that the flaw may allow a malicious user to overwrite arbitrary files, resulting in a loss of integrity. |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2006-07-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-081.nasl - Type : ACT_GATHER_INFO |
2006-05-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_27a70a015f6c11da8d54000cf18bbe54.nasl - Type : ACT_GATHER_INFO |
2006-01-15 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3-1.nasl - Type : ACT_GATHER_INFO |
2005-10-05 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-081.nasl - Type : ACT_GATHER_INFO |
2004-10-21 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200410-18.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:49:00 |
|