Bug 201042 - net-print/cups < 1.2.12-r4 insecure temporary file creation in pdftops (CVE-2007-6358)
Bug#: 201042 Product:  Gentoo Security Version: unspecified Platform: All
OS/Version: Linux Status: RESOLVED Severity: normal Priority: P2
Resolution: FIXED Assigned To: security@gentoo.org Reported By: pipping@gentoo.org
Component: Vulnerabilities
URL:  http://www.cups.org/articles.php?L515
Summary: net-print/cups < 1.2.12-r4 insecure temporary file creation in pdftops (CVE-2007-6358)
Keywords:  
Status Whiteboard: A3 [glsa]
Opened: 2007-12-03 00:32 0000
Description:   Opened: 2007-12-03 00:32 0000 
files/pdftops.pl uses insecurely created files in /tmp, same kind of issue than
bug #198231.

the offending line (90) is:

my $tmpfile = $ENV{TMPDIR} . "pdfin.$$.tmp";

------- Comment #1 From Elias Pipping (RETIRED) 2007-12-03 00:32:37 0000 ------- 
remove leftover from cloning a bug

------- Comment #2 From Robert Buchholz 2007-12-03 00:49:04 0000 ------- 
This problem lies not within CUPS' pdftops filter, but in our alternative
filter which is credited as follows. I'll try to contact the author about this.


# pdftops.pl - wrapper script for xpdf's pdftops utility to act as a CUPS
filter
#
==============================================================================
# 1.00 - 2004-10-05/Bl
#       Initial implementation
#
# Copyright: Helge Blischke / SRZ Berlin 2004
# This program is free seoftware and governed by the GNU Public License Version
2.

------- Comment #3 From Robert Buchholz 2007-12-03 17:15:09 0000 ------- 
Upstream provided a new version.

------- Comment #4 From Robert Buchholz 2007-12-03 17:15:26 0000 ------- 
Created an attachment (id=137630) [details]
pdftops-1.20

------- Comment #5 From Robert Buchholz 2007-12-03 17:25:19 0000 ------- 
The temporary file is created when reading a PDF file from stdin. Does CUPS use
the filter this way, or is it handing over a local file?

------- Comment #6 From Robert Buchholz 2007-12-04 17:52:00 0000 ------- 
On my cups installation, the cupsd saves PDF files to print in /var/spool/cups/
and calls pdftops with that file as a paramater:

22844 execve("/usr/libexec/cups/filter/pdftops", ["null"..., "18"..., "rbu"...,
"gentoo-bash.pdf"..., "1"..., "job-uuid=urn:uuid:d2f67463-b293-"...,
"/var/spool/cups/d00018-002"...], [/* 24 vars */] <unfinished ...>

Under what circumstances would it call the filter via stdin?

------- Comment #7 From Robert Buchholz 2007-12-06 16:22:31 0000 ------- 
More details: Filename pattern $TMPDIR/pdfin.$$.tmp
privileges: "lp" user

This vulnerability appears when more than one filter is triggered in 
CUPS (i.e. you print an XML file and have an XML->PDF and PDF-PS 
converter), because if you only convert PDF to PS, cups will hand over 
the pdf file in "/var/spool" via filename, pdftops will not use its 
stdin code.

------- Comment #8 From Robert Buchholz 2007-12-06 16:23:16 0000 ------- 
printing, please bump with the new version.

------- Comment #9 From Robert Buchholz 2007-12-06 17:10:05 0000 ------- 
Created an attachment (id=137890) [details]
pdftops-1.10-1.20.patch

patch from 1.10 to 1.20

------- Comment #10 From Robert Buchholz 2007-12-18 21:35:33 0000 ------- 
This will be GLSA'd with bug 201570.

------- Comment #11 From Robert Buchholz 2007-12-18 22:29:31 0000 ------- 
GLSA 200712-14, thanks everyone.