Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 100265 - app-text/gpdf: DoS from XPDF issue
Summary: app-text/gpdf: DoS from XPDF issue
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: A4 [glsa] koon
Keywords:
Depends on:
Blocks:
 
Reported: 2005-07-25 11:53 UTC by Sune Kloppenborg Jeppesen
Modified: 2005-08-15 22:26 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
gpdf-xpdf-font-optimize-allanonjl.dif (gpdf-xpdf-font-optimize-allanonjl.dif,21.90 KB, patch)
2005-07-30 12:33 UTC, John N. Laliberte (RETIRED)
no flags Details | Diff
gpdf-2.8.2-CAN-2005-2097.patch (gpdf-2.8.2-CAN-2005-2097.patch,1.93 KB, patch)
2005-08-12 00:59 UTC, Thierry Carrez (RETIRED)
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Sune Kloppenborg Jeppesen gentoo-dev 2005-07-25 11:53:36 UTC
See bug #99769.
Comment 1 Thierry Carrez (RETIRED) gentoo-dev 2005-07-30 07:08:44 UTC
Pulling in Allanonjl
Comment 2 John N. Laliberte (RETIRED) gentoo-dev 2005-07-30 08:56:51 UTC
xpdf/SplashOutputDev.cc <-- this file is not distributed with the xpdf in gpdf,
but all the other files are.

The top of the included README says:
Xpdf
====

version 3.00
2004-jan-22


Its not clear to me that this version is affected without a test pdf.

Heres the GNOME viewcvs view of the xpdf directory[1], and mysteriously,
SplashOutputDev.cc is there, but SplashOutputDev.cc does not appear in the
tarballs[2].  Seems like the file(s) is/are excluded when they build it.

[1] http://cvs.gnome.org/viewcvs/gpdf/xpdf/

[2] http://ftp.gnome.org/pub/GNOME/sources/gpdf/
Comment 3 John N. Laliberte (RETIRED) gentoo-dev 2005-07-30 12:32:10 UTC
The provided patch was a tad different in a few places.  I'm attaching my patch
which is just a little bit different.

However, a major portion of the diff could not be applied because
SplashOutputDev.cc is not included in gpdf's source.  Its not even in the
Makefile, so I don't think its supposed to be there either.  The content doesn't
seem to be in any other file in the gpdf package either.

My patch applies cleanly to 2.8.3 what I used for testing, but leaves out a
large portion at the end of the supplied patch to SplashOutputDev.cc.

Bottom line is that even with my patch gpdf is still affected ( tested with a
bad pdf ).
Comment 4 John N. Laliberte (RETIRED) gentoo-dev 2005-07-30 12:33:24 UTC
Created attachment 64745 [details, diff]
gpdf-xpdf-font-optimize-allanonjl.dif
Comment 5 Heinrich Wendel (RETIRED) gentoo-dev 2005-08-04 08:27:09 UTC
i also have problems applying it to xpdf, maybe another suse patch is needed 
before 
Comment 6 John N. Laliberte (RETIRED) gentoo-dev 2005-08-06 18:03:21 UTC
With the 2nd patch applied in the parent bug, everything applies cleanly except
for the missing file SplashOutputDev.cc ( in both patches ). Gpdf is still affected.

So, I did some more digging.

Basically, the gpdf guys created their own OutputDev called GPOutputDev.cc.  I
believe this is where they implement the functionality of SplashOutputDev.cc.

Tonight / Tommorrow I'll try and hack out a patch against GPOutputDev.cc that
fixes this.
Comment 7 Thierry Carrez (RETIRED) gentoo-dev 2005-08-07 08:39:32 UTC
Have a try, if you don't succeed, we can wait for an official gpdf release
taking this into account...
Comment 8 Thierry Carrez (RETIRED) gentoo-dev 2005-08-09 00:40:38 UTC
client-based DoS -> downgrading severity
Comment 9 Thierry Carrez (RETIRED) gentoo-dev 2005-08-09 13:25:08 UTC
Now public
AllanonJL: any success in patching ? anything up in gpdf upstream ?
Comment 10 Thierry Carrez (RETIRED) gentoo-dev 2005-08-09 13:47:35 UTC
Adding herd alias rather than individual names.
Comment 11 John N. Laliberte (RETIRED) gentoo-dev 2005-08-09 14:05:22 UTC
I didn't successfully patch it w/o breaking functionality of gpdf.  While the
file is similar, I didn't have enough time to fully understand what they are
doing in GPOutputDev. ( I may have time this weekend )

nothing has changed upstream for gpdf.
Comment 12 Thierry Carrez (RETIRED) gentoo-dev 2005-08-10 00:37:12 UTC
So we should wait for upstream.

Maybe someone who already has a Gnome bugzilla account can post a bug there ?
You can point them to http://www.kde.org/info/security/advisory-20050809-1.txt
Note: Do not provide the PoC PDF on Bugzilla, but you can send it to the
developer in charge in case of need.
Comment 13 John N. Laliberte (RETIRED) gentoo-dev 2005-08-10 06:12:50 UTC
done, see:
http://bugs.gnome.org/show_bug.cgi?id=313117
Comment 14 Thierry Carrez (RETIRED) gentoo-dev 2005-08-12 00:59:17 UTC
Created attachment 65732 [details, diff]
gpdf-2.8.2-CAN-2005-2097.patch

Patch from Mandriva SRPMS, apparently originally from RedHat.
Comment 15 Thierry Carrez (RETIRED) gentoo-dev 2005-08-12 01:00:00 UTC
AllanonJL: you could try this new one and see if it fixes.
Comment 16 John N. Laliberte (RETIRED) gentoo-dev 2005-08-12 06:37:42 UTC
patch applied, tested, and committed.

gpdf-2.10.0-r1.ebuild
Comment 17 Thierry Carrez (RETIRED) gentoo-dev 2005-08-12 08:19:31 UTC
Arches, please test gpdf-2.10.0-r1 and mark stable accordingly.
Comment 18 Gustavo Zacarias (RETIRED) gentoo-dev 2005-08-12 08:41:14 UTC
sparc stable.
Comment 19 Markus Rothe (RETIRED) gentoo-dev 2005-08-12 09:02:48 UTC
stable on ppc64
Comment 20 Luis Medinas (RETIRED) gentoo-dev 2005-08-12 09:20:08 UTC
Marked Stable on AMD64.
Comment 21 Mr. Bones. (RETIRED) gentoo-dev 2005-08-12 09:36:27 UTC
I resurrected gpdf-2.10.0.ebuild until -r1 is stable.  Removing the stable
version out from under everyone is not the way we do it.
Comment 22 Lars Weiler (RETIRED) gentoo-dev 2005-08-12 10:43:01 UTC
Stable on ppc.
Comment 23 Aaron Walker (RETIRED) gentoo-dev 2005-08-12 11:14:07 UTC
mips stable.
Comment 24 Bryan Østergaard (RETIRED) gentoo-dev 2005-08-12 15:13:17 UTC
Stable on alpha + ia64.
Comment 25 Michael Hanselmann (hansmi) (RETIRED) gentoo-dev 2005-08-13 00:30:34 UTC
Stable on hppa.
Comment 26 Sune Kloppenborg Jeppesen gentoo-dev 2005-08-15 22:26:59 UTC
GLSA 200508-08