Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug
Bug#: 201042
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Elias Pipping (RETIRED) <pipping@gentoo.org>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
pdftops-1.20 pdftops-1.20 text/plain Robert Buchholz 2007-12-03 17:15 0000 10.19 KB Details
pdftops-1.10-1.20.patch pdftops-1.10-1.20.patch patch Robert Buchholz 2007-12-06 17:10 0000 1.51 KB Details | Diff
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 201042 depends on: Show dependency tree
Bug 201042 blocks:

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2007-12-03 00:32 0000 
files/pdftops.pl uses insecurely created files in /tmp, same kind of issue than
bug #198231.

the offending line (90) is:

my $tmpfile = $ENV{TMPDIR} . "pdfin.$$.tmp";

------- Comment #1 From Elias Pipping (RETIRED) 2007-12-03 00:32:37 0000 ------- 
remove leftover from cloning a bug

------- Comment #2 From Robert Buchholz 2007-12-03 00:49:04 0000 ------- 
This problem lies not within CUPS' pdftops filter, but in our alternative
filter which is credited as follows. I'll try to contact the author about this.


# pdftops.pl - wrapper script for xpdf's pdftops utility to act as a CUPS
filter
#
==============================================================================
# 1.00 - 2004-10-05/Bl
#       Initial implementation
#
# Copyright: Helge Blischke / SRZ Berlin 2004
# This program is free seoftware and governed by the GNU Public License Version
2.

------- Comment #3 From Robert Buchholz 2007-12-03 17:15:09 0000 ------- 
Upstream provided a new version.

------- Comment #4 From Robert Buchholz 2007-12-03 17:15:26 0000 ------- 
Created an attachment (id=137630) [details]
pdftops-1.20

------- Comment #5 From Robert Buchholz 2007-12-03 17:25:19 0000 ------- 
The temporary file is created when reading a PDF file from stdin. Does CUPS use
the filter this way, or is it handing over a local file?

------- Comment #6 From Robert Buchholz 2007-12-04 17:52:00 0000 ------- 
On my cups installation, the cupsd saves PDF files to print in /var/spool/cups/
and calls pdftops with that file as a paramater:

22844 execve("/usr/libexec/cups/filter/pdftops", ["null"..., "18"..., "rbu"...,
"gentoo-bash.pdf"..., "1"..., "job-uuid=urn:uuid:d2f67463-b293-"...,
"/var/spool/cups/d00018-002"...], [/* 24 vars */] <unfinished ...>

Under what circumstances would it call the filter via stdin?

------- Comment #7 From Robert Buchholz 2007-12-06 16:22:31 0000 ------- 
More details: Filename pattern $TMPDIR/pdfin.$$.tmp
privileges: "lp" user

This vulnerability appears when more than one filter is triggered in 
CUPS (i.e. you print an XML file and have an XML->PDF and PDF-PS 
converter), because if you only convert PDF to PS, cups will hand over 
the pdf file in "/var/spool" via filename, pdftops will not use its 
stdin code.

------- Comment #8 From Robert Buchholz 2007-12-06 16:23:16 0000 ------- 
printing, please bump with the new version.

------- Comment #9 From Robert Buchholz 2007-12-06 17:10:05 0000 ------- 
Created an attachment (id=137890) [details]
pdftops-1.10-1.20.patch

patch from 1.10 to 1.20

------- Comment #10 From Robert Buchholz 2007-12-18 21:35:33 0000 ------- 
This will be GLSA'd with bug 201570.

------- Comment #11 From Robert Buchholz 2007-12-18 22:29:31 0000 ------- 
GLSA 200712-14, thanks everyone.
Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug