[RHSA-2002:083-22] Ghostscript command execution vulnerability
Date: Tue, 4 Jun 2002 15:39 -0400
From: bugzilla@redhat.com
To: redhat-watch-list@redhat.com
Subject: [RHSA-2002:083-22] Ghostscript command execution vulnerability
Cc: bugtraq@securityfocus.com, linux-security@redhat.com
---------------------------------------------------------------------
Red Hat, Inc. Red Hat Security Advisory
Synopsis: Ghostscript command execution vulnerability
Advisory ID: RHSA-2002:083-22
Issue date: 2002-05-07
Updated on: 2002-06-03
Product: Red Hat Linux
Ключевые слова: , , , , , , , , , ghostscript, SAFER, PARANOIDSAFER, (найти похожие документы)
Cross references:=20=20
Obsoletes: RHSA-2001:112 RHSA-2001:138
CVE Names: CAN-2002-0363
---------------------------------------------------------------------
1. Topic:
Updated packages are available for GNU Ghostscript which fix a
vulnerability found during Postscript interpretation.
2. Relevant releases/architectures:
Red Hat Linux 6.2 - alpha, i386, noarch, sparc
Red Hat Linux 7.0 - alpha, i386, noarch
Red Hat Linux 7.1 - alpha, i386, ia64
Red Hat Linux 7.2 - i386, ia64
Red Hat Linux 7.3 - i386
3. Problem description:
Ghostscript is a program for displaying PostScript files or printing them
to non-PostScript printers.
An untrusted PostScript file can cause ghostscript to execute arbitrary
commands due to insufficient checking. Since ghostscript is often used
during the course of printing a document (and is run as user 'lp'), all
users should install these fixed packages.
The problem is fixed in the 6.53 source release of GNU Ghostscript, and the
fix has been backported and applied to the packages referenced by this
advisory.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2002-0363 to this issue.
Please note that this vulnerability is different to the 'local file read'
issue corrected by our previous Ghostscript errata (RHSA-2001:112 and
RHSA-2001:138)
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.
Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
6. RPMs required:
Red Hat Linux 6.2:
SRPMS:
ftp://updates.redhat.com/6.2/en/os/SRPMS/ghostscript-6.51-16.1.6x.1.src.rpm
ftp://updates.redhat.com/6.2/en/os/SRPMS/VFlib2-2.25.1-11.6x.src.rpm
ftp://updates.redhat.com/6.2/en/os/SRPMS/xtt-fonts-0.19990222-8.6x.src.rpm
alpha:
ftp://updates.redhat.com/6.2/en/os/alpha/ghostscript-6.51-16.1.6x.1.alpha.r=
pm
ftp://updates.redhat.com/6.2/en/os/alpha/VFlib2-2.25.1-11.6x.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/VFlib2-devel-2.25.1-11.6x.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/VFlib2-VFjfm-2.25.1-11.6x.alpha.rpm
i386:
ftp://updates.redhat.com/6.2/en/os/i386/ghostscript-6.51-16.1.6x.1.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/VFlib2-2.25.1-11.6x.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/VFlib2-devel-2.25.1-11.6x.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/VFlib2-VFjfm-2.25.1-11.6x.i386.rpm
noarch:
ftp://updates.redhat.com/6.2/en/os/noarch/xtt-fonts-0.19990222-8.6x.noarch.=
rpm
sparc:
ftp://updates.redhat.com/6.2/en/os/sparc/ghostscript-6.51-16.1.6x.1.sparc.r=
pm
ftp://updates.redhat.com/6.2/en/os/sparc/VFlib2-2.25.1-11.6x.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/VFlib2-devel-2.25.1-11.6x.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/VFlib2-VFjfm-2.25.1-11.6x.sparc.rpm
Red Hat Linux 7.0:
SRPMS:
ftp://updates.redhat.com/7.0/en/os/SRPMS/ghostscript-6.51-16.1.7x.src.rpm
ftp://updates.redhat.com/7.0/en/os/SRPMS/VFlib2-2.25.1-12.src.rpm
ftp://updates.redhat.com/7.0/en/os/SRPMS/xtt-fonts-0.19990222-9.src.rpm
alpha:
ftp://updates.redhat.com/7.0/en/os/alpha/ghostscript-6.51-16.1.7x.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/VFlib2-2.25.1-12.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/VFlib2-devel-2.25.1-12.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/VFlib2-VFjfm-2.25.1-12.alpha.rpm
i386:
ftp://updates.redhat.com/7.0/en/os/i386/ghostscript-6.51-16.1.7x.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/VFlib2-2.25.1-12.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/VFlib2-devel-2.25.1-12.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/VFlib2-VFjfm-2.25.1-12.i386.rpm
noarch:
ftp://updates.redhat.com/7.0/en/os/noarch/xtt-fonts-0.19990222-9.noarch.rpm
Red Hat Linux 7.1:
SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/ghostscript-6.51-16.1.7x.src.rpm
alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/ghostscript-6.51-16.1.7x.alpha.rpm
i386:
ftp://updates.redhat.com/7.1/en/os/i386/ghostscript-6.51-16.1.7x.i386.rpm
ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/ghostscript-6.51-16.1.7x.ia64.rpm
Red Hat Linux 7.2:
SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/ghostscript-6.51-16.2.src.rpm
ftp://updates.redhat.com/7.2/en/os/SRPMS/printconf-0.3.61-4.1.src.rpm
i386:
ftp://updates.redhat.com/7.2/en/os/i386/ghostscript-6.51-16.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/printconf-0.3.61-4.1.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/printconf-gui-0.3.61-4.1.i386.rpm
ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/ghostscript-6.51-16.2.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/printconf-0.3.61-4.1.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/printconf-gui-0.3.61-4.1.ia64.rpm
Red Hat Linux 7.3:
SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/ghostscript-6.52-9.4.src.rpm
i386:
ftp://updates.redhat.com/7.3/en/os/i386/ghostscript-6.52-9.4.i386.rpm
7. Verification:
MD5 sum Package Name
--------------------------------------------------------------------------
39b9b94fb6a17c6d3a02c9e52db84d75 6.2/en/os/SRPMS/VFlib2-2.25.1-11.6x.src.rpm
fd9392c8956670b0032136e7470ebb4b 6.2/en/os/SRPMS/ghostscript-6.51-16.1.6x.1=
.src.rpm
2be01efc98d82b5f1b5ed8cd58ae38ca 6.2/en/os/SRPMS/xtt-fonts-0.19990222-8.6x.=
src.rpm
a0f75f1ca786acf5352f150d517d9ac5 6.2/en/os/alpha/VFlib2-2.25.1-11.6x.alpha.=
rpm
dbfb7d677e1a94bf3070abb662e406b5 6.2/en/os/alpha/VFlib2-VFjfm-2.25.1-11.6x.=
alpha.rpm
7077d0eb914bf0cb72431c883735821f 6.2/en/os/alpha/VFlib2-devel-2.25.1-11.6x.=
alpha.rpm
d7734831910f1e8de8fe022cbae8a3d7 6.2/en/os/alpha/ghostscript-6.51-16.1.6x.1=
.alpha.rpm
2ae611a68c01f9376b825b536068669c 6.2/en/os/i386/VFlib2-2.25.1-11.6x.i386.rpm
21420c0e8e89c78205e00f251e66f844 6.2/en/os/i386/VFlib2-VFjfm-2.25.1-11.6x.i=
386.rpm
1b757aea2d8051f8922961501f9a8678 6.2/en/os/i386/VFlib2-devel-2.25.1-11.6x.i=
386.rpm
e54c57c10e28fd145c5e1f97f3f8f5ed 6.2/en/os/i386/ghostscript-6.51-16.1.6x.1.=
i386.rpm
1455e9fc7056f4593cee248a580d6fae 6.2/en/os/noarch/xtt-fonts-0.19990222-8.6x=
.noarch.rpm
18baaa094259076a7edd4c4d7d2ec7e9 6.2/en/os/sparc/VFlib2-2.25.1-11.6x.sparc.=
rpm
c2fe83310287c7f1f0ca743261240c28 6.2/en/os/sparc/VFlib2-VFjfm-2.25.1-11.6x.=
sparc.rpm
ebbc6503b8f99e1e3dd79ad9766cac04 6.2/en/os/sparc/VFlib2-devel-2.25.1-11.6x.=
sparc.rpm
fbf618b69fd5404081d761029778c696 6.2/en/os/sparc/ghostscript-6.51-16.1.6x.1=
.sparc.rpm
d25a61585c232c8f56d5ec49922ad246 7.0/en/os/SRPMS/VFlib2-2.25.1-12.src.rpm
93532d180a459cf853a59945ff81b6ee 7.0/en/os/SRPMS/ghostscript-6.51-16.1.7x.s=
rc.rpm
40037639055d00c9b4f1af144beabee4 7.0/en/os/SRPMS/xtt-fonts-0.19990222-9.src=
.rpm
b1a69584ede57bd1a264e8e892d9e182 7.0/en/os/alpha/VFlib2-2.25.1-12.alpha.rpm
bea84891fe60e6c08005b7a9d9219e11 7.0/en/os/alpha/VFlib2-VFjfm-2.25.1-12.alp=
ha.rpm
75dd6c3d2d5af442fc6f150a4d71671a 7.0/en/os/alpha/VFlib2-devel-2.25.1-12.alp=
ha.rpm
8fe589c020ef43db2b27dfc47fd8b4be 7.0/en/os/alpha/ghostscript-6.51-16.1.7x.a=
lpha.rpm
ee7127247a44d2e49f0be52d815db09d 7.0/en/os/i386/VFlib2-2.25.1-12.i386.rpm
979ea17d5ef0db8f9e825381453524fb 7.0/en/os/i386/VFlib2-VFjfm-2.25.1-12.i386=
.rpm
9a5a772d9b9bd01b3b80e130ece11c48 7.0/en/os/i386/VFlib2-devel-2.25.1-12.i386=
.rpm
a317acb4dbee54a5239356f1d3612df6 7.0/en/os/i386/ghostscript-6.51-16.1.7x.i3=
86.rpm
bf996108e1bfed22384d849a10a03807 7.0/en/os/noarch/xtt-fonts-0.19990222-9.no=
arch.rpm
93532d180a459cf853a59945ff81b6ee 7.1/en/os/SRPMS/ghostscript-6.51-16.1.7x.s=
rc.rpm
8fe589c020ef43db2b27dfc47fd8b4be 7.1/en/os/alpha/ghostscript-6.51-16.1.7x.a=
lpha.rpm
a317acb4dbee54a5239356f1d3612df6 7.1/en/os/i386/ghostscript-6.51-16.1.7x.i3=
86.rpm
75db622c8177dffc116f221d678f7c0d 7.1/en/os/ia64/ghostscript-6.51-16.1.7x.ia=
64.rpm
ddb0f44bdbd59608cf1a0e07bc4fdf01 7.2/en/os/SRPMS/ghostscript-6.51-16.2.src.=
rpm
c5232bb663dbde2e04d7b19cbba87246 7.2/en/os/SRPMS/printconf-0.3.61-4.1.src.r=
pm
04199f3a2f4fa4b6998c6b229c4f4f3a 7.2/en/os/i386/ghostscript-6.51-16.2.i386.=
rpm
c722ab94c36110b54e600854e7e5f20d 7.2/en/os/i386/printconf-0.3.61-4.1.i386.r=
pm
3156e37a7252c3603b83310b0b4cd50b 7.2/en/os/i386/printconf-gui-0.3.61-4.1.i3=
86.rpm
448bb8057d7669158c19efeae2f310ec 7.2/en/os/ia64/ghostscript-6.51-16.2.ia64.=
rpm
aea25c90e71a2f3d927aa0c62a29c687 7.2/en/os/ia64/printconf-0.3.61-4.1.ia64.r=
pm
53ce3bddd1f78b5de5067478f719b39f 7.2/en/os/ia64/printconf-gui-0.3.61-4.1.ia=
64.rpm
a447ff805d6d55a9e93498bdb41699a5 7.3/en/os/SRPMS/ghostscript-6.52-9.4.src.r=
pm
0f85846611c14aad7ca81e2a36f1247e 7.3/en/os/i386/ghostscript-6.52-9.4.i386.r=
pm
=20
These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at:
http://www.redhat.com/about/contact/pgpkey.html
You can verify each package with the following command:
rpm --checksig <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2002-0363
Copyright(c) 2000, 2001, 2002 Red Hat, Inc.
