Vulnerabilities > CVE-2005-3662 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Greg Roelofs Pnmtopng

047910
CVSS 4.6 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
local
low complexity
greg-roelofs
CWE-119
nessus

Summary

Off-by-one buffer overflow in pnmtopng before 2.39, when using the -alpha command line option (Alphas_Of_Color), allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PNM file with exactly 256 colors.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2005-843.NASL
    descriptionUpdated netpbm packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The netpbm package contains a library of functions that support programs for handling various graphics file formats. A stack based buffer overflow bug was found in the way netpbm converts Portable Anymap (PNM) files into Portable Network Graphics (PNG). A specially crafted PNM file could allow an attacker to execute arbitrary code by attempting to convert a PNM file to a PNG file when using pnmtopng with the
    last seen2020-06-01
    modified2020-06-02
    plugin id21874
    published2006-07-03
    reporterThis script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/21874
    titleCentOS 3 : netpbm (CESA-2005:843)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2005:843 and 
    # CentOS Errata and Security Advisory 2005:843 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(21874);
      script_version("1.18");
      script_cvs_date("Date: 2019/10/25 13:36:03");
    
      script_cve_id("CVE-2005-3632", "CVE-2005-3662");
      script_bugtraq_id(15427, 15514);
      script_xref(name:"RHSA", value:"2005:843");
    
      script_name(english:"CentOS 3 : netpbm (CESA-2005:843)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated netpbm packages that fix two security issues are now
    available.
    
    This update has been rated as having moderate security impact by the
    Red Hat Security Response Team.
    
    The netpbm package contains a library of functions that support
    programs for handling various graphics file formats.
    
    A stack based buffer overflow bug was found in the way netpbm converts
    Portable Anymap (PNM) files into Portable Network Graphics (PNG). A
    specially crafted PNM file could allow an attacker to execute
    arbitrary code by attempting to convert a PNM file to a PNG file when
    using pnmtopng with the '-text' option. The Common Vulnerabilities and
    Exposures project has assigned the name CVE-2005-3632 to this issue.
    
    An 'off by one' bug was found in the way netpbm converts Portable
    Anymap (PNM) files into Portable Network Graphics (PNG). If a victim
    attempts to convert a specially crafted 256 color PNM file to a PNG
    file, then it can cause the pnmtopng utility to crash. The Common
    Vulnerabilities and Exposures project has assigned the name
    CVE-2005-3662 to this issue.
    
    All users of netpbm should upgrade to these updated packages, which
    contain backported patches that resolve these issues."
      );
      # https://lists.centos.org/pipermail/centos-announce/2005-December/012480.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?98560b19"
      );
      # https://lists.centos.org/pipermail/centos-announce/2005-December/012481.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?0a4715af"
      );
      # https://lists.centos.org/pipermail/centos-announce/2005-December/012489.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?31a9e645"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected netpbm packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:netpbm");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:netpbm-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:netpbm-progs");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2005/11/17");
      script_set_attribute(attribute:"patch_publication_date", value:"2005/12/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2006/07/03");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^3([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 3.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-3", reference:"netpbm-9.24-11.30.4")) flag++;
    if (rpm_check(release:"CentOS-3", reference:"netpbm-devel-9.24-11.30.4")) flag++;
    if (rpm_check(release:"CentOS-3", reference:"netpbm-progs-9.24-11.30.4")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "netpbm / netpbm-devel / netpbm-progs");
    }
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2005-217.NASL
    descriptionGreg Roelofs discovered and fixed several buffer overflows in pnmtopng which is also included in netpbm, a collection of graphic conversion utilities, that can lead to the execution of arbitrary code via a specially crafted PNM file. Multiple buffer overflows in pnmtopng in netpbm 10.0 and earlier allow attackers to execute arbitrary code via a crafted PNM file. (CVE-2005-3632) An off-by-one buffer overflow in pnmtopng, when using the -alpha command line option, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PNM file with exactly 256 colors. (CVE-2005-3662) The updated packages have been patched to correct this problem.
    last seen2020-06-01
    modified2020-06-02
    plugin id20449
    published2006-01-15
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/20449
    titleMandrake Linux Security Advisory : netpbm (MDKSA-2005:217)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandrake Linux Security Advisory MDKSA-2005:217. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(20449);
      script_version ("1.16");
      script_cvs_date("Date: 2019/08/02 13:32:48");
    
      script_cve_id("CVE-2005-3632", "CVE-2005-3662");
      script_bugtraq_id(15427, 15514);
      script_xref(name:"MDKSA", value:"2005:217");
    
      script_name(english:"Mandrake Linux Security Advisory : netpbm (MDKSA-2005:217)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandrake Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Greg Roelofs discovered and fixed several buffer overflows in pnmtopng
    which is also included in netpbm, a collection of graphic conversion
    utilities, that can lead to the execution of arbitrary code via a
    specially crafted PNM file.
    
    Multiple buffer overflows in pnmtopng in netpbm 10.0 and earlier allow
    attackers to execute arbitrary code via a crafted PNM file.
    (CVE-2005-3632)
    
    An off-by-one buffer overflow in pnmtopng, when using the -alpha
    command line option, allows attackers to cause a denial of service
    (crash) and possibly execute arbitrary code via a crafted PNM file
    with exactly 256 colors. (CVE-2005-3662)
    
    The updated packages have been patched to correct this problem."
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64netpbm9");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64netpbm9-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64netpbm9-static-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libnetpbm9");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libnetpbm9-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libnetpbm9-static-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:netpbm");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2005/11/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2006/01/15");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2006-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK10.1", cpu:"x86_64", reference:"lib64netpbm9-9.24-8.2.101mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", cpu:"x86_64", reference:"lib64netpbm9-devel-9.24-8.2.101mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", cpu:"x86_64", reference:"lib64netpbm9-static-devel-9.24-8.2.101mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"libnetpbm9-9.24-8.2.101mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"libnetpbm9-devel-9.24-8.2.101mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"libnetpbm9-static-devel-9.24-8.2.101mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.1", reference:"netpbm-9.24-8.2.101mdk", yank:"mdk")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-904.NASL
    descriptionGreg Roelofs discovered and fixed several buffer overflows in pnmtopng which is also included in netpbm, a collection of graphic conversion utilities, that can lead to the execution of arbitrary code via a specially crafted PNM file.
    last seen2020-06-01
    modified2020-06-02
    plugin id22770
    published2006-10-14
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/22770
    titleDebian DSA-904-1 : netpbm-free - buffer overflows
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-904. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(22770);
      script_version("1.16");
      script_cvs_date("Date: 2019/08/02 13:32:19");
    
      script_cve_id("CVE-2005-3632", "CVE-2005-3662");
      script_xref(name:"DSA", value:"904");
    
      script_name(english:"Debian DSA-904-1 : netpbm-free - buffer overflows");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Greg Roelofs discovered and fixed several buffer overflows in pnmtopng
    which is also included in netpbm, a collection of graphic conversion
    utilities, that can lead to the execution of arbitrary code via a
    specially crafted PNM file."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.debian.org/security/2005/dsa-904"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the netpbm package.
    
    For the old stable distribution (woody) these problems have been fixed
    in version 9.20-8.5.
    
    For the stable distribution (sarge) these problems have been fixed in
    version 10.0-8sarge2."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:netpbm-free");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2005/11/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2006/10/14");
      script_set_attribute(attribute:"vuln_publication_date", value:"2005/11/12");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2006-2019 Tenable Network Security, Inc.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"3.0", prefix:"libnetpbm9", reference:"9.20-8.5")) flag++;
    if (deb_check(release:"3.0", prefix:"libnetpbm9-dev", reference:"9.20-8.5")) flag++;
    if (deb_check(release:"3.0", prefix:"netpbm", reference:"9.20-8.5")) flag++;
    if (deb_check(release:"3.1", prefix:"libnetpbm10", reference:"10.0-8sarge2")) flag++;
    if (deb_check(release:"3.1", prefix:"libnetpbm10-dev", reference:"10.0-8sarge2")) flag++;
    if (deb_check(release:"3.1", prefix:"libnetpbm9", reference:"10.0-8sarge2")) flag++;
    if (deb_check(release:"3.1", prefix:"libnetpbm9-dev", reference:"10.0-8sarge2")) flag++;
    if (deb_check(release:"3.1", prefix:"netpbm", reference:"10.0-8sarge2")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2005-843.NASL
    descriptionUpdated netpbm packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The netpbm package contains a library of functions that support programs for handling various graphics file formats. A stack based buffer overflow bug was found in the way netpbm converts Portable Anymap (PNM) files into Portable Network Graphics (PNG). A specially crafted PNM file could allow an attacker to execute arbitrary code by attempting to convert a PNM file to a PNG file when using pnmtopng with the
    last seen2020-06-01
    modified2020-06-02
    plugin id20360
    published2005-12-30
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/20360
    titleRHEL 2.1 / 3 : netpbm (RHSA-2005:843)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2005:843. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(20360);
      script_version ("1.23");
      script_cvs_date("Date: 2019/10/25 13:36:11");
    
      script_cve_id("CVE-2005-3632", "CVE-2005-3662");
      script_bugtraq_id(15427, 15514);
      script_xref(name:"RHSA", value:"2005:843");
    
      script_name(english:"RHEL 2.1 / 3 : netpbm (RHSA-2005:843)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated netpbm packages that fix two security issues are now
    available.
    
    This update has been rated as having moderate security impact by the
    Red Hat Security Response Team.
    
    The netpbm package contains a library of functions that support
    programs for handling various graphics file formats.
    
    A stack based buffer overflow bug was found in the way netpbm converts
    Portable Anymap (PNM) files into Portable Network Graphics (PNG). A
    specially crafted PNM file could allow an attacker to execute
    arbitrary code by attempting to convert a PNM file to a PNG file when
    using pnmtopng with the '-text' option. The Common Vulnerabilities and
    Exposures project has assigned the name CVE-2005-3632 to this issue.
    
    An 'off by one' bug was found in the way netpbm converts Portable
    Anymap (PNM) files into Portable Network Graphics (PNG). If a victim
    attempts to convert a specially crafted 256 color PNM file to a PNG
    file, then it can cause the pnmtopng utility to crash. The Common
    Vulnerabilities and Exposures project has assigned the name
    CVE-2005-3662 to this issue.
    
    All users of netpbm should upgrade to these updated packages, which
    contain backported patches that resolve these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-3632"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2005-3662"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2005:843"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Update the affected netpbm, netpbm-devel and / or netpbm-progs
    packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:netpbm");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:netpbm-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:netpbm-progs");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:2.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2005/11/17");
      script_set_attribute(attribute:"patch_publication_date", value:"2005/12/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/12/30");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(2\.1|3)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 2.1 / 3.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2005:843";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"netpbm-9.24-9.AS21.6")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"netpbm-devel-9.24-9.AS21.6")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"netpbm-progs-9.24-9.AS21.6")) flag++;
    
      if (rpm_check(release:"RHEL3", reference:"netpbm-9.24-11.30.4")) flag++;
      if (rpm_check(release:"RHEL3", reference:"netpbm-devel-9.24-11.30.4")) flag++;
      if (rpm_check(release:"RHEL3", reference:"netpbm-progs-9.24-11.30.4")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "netpbm / netpbm-devel / netpbm-progs");
      }
    }
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-218-1.NASL
    descriptionTwo buffer overflows were discovered in the
    last seen2020-06-01
    modified2020-06-02
    plugin id20636
    published2006-01-15
    reporterUbuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/20636
    titleUbuntu 4.10 / 5.04 / 5.10 : netpbm-free vulnerabilities (USN-218-1)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-218-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(20636);
      script_version("1.14");
      script_cvs_date("Date: 2019/08/02 13:33:00");
    
      script_cve_id("CVE-2005-3632", "CVE-2005-3662");
      script_xref(name:"USN", value:"218-1");
    
      script_name(english:"Ubuntu 4.10 / 5.04 / 5.10 : netpbm-free vulnerabilities (USN-218-1)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Two buffer overflows were discovered in the 'pnmtopng' tool, which
    were triggered by processing an image with exactly 256 colors when
    using the -alpha option (CVE-2005-3662) or by processing a text file
    with very long lines when using the -text option (CVE-2005-3632).
    
    A remote attacker could exploit these to execute arbitrary code by
    tricking an user or an automated system into processing a specially
    crafted PNM file with pnmtopng.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnetpbm10");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnetpbm10-dev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnetpbm9");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnetpbm9-dev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:netpbm");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:4.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:5.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:5.10");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2005/11/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2006/01/15");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! ereg(pattern:"^(4\.10|5\.04|5\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 4.10 / 5.04 / 5.10", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"4.10", pkgname:"libnetpbm10", pkgver:"10.0-5ubuntu0.3")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"libnetpbm10-dev", pkgver:"10.0-5ubuntu0.3")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"libnetpbm9", pkgver:"10.0-5ubuntu0.3")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"libnetpbm9-dev", pkgver:"10.0-5ubuntu0.3")) flag++;
    if (ubuntu_check(osver:"4.10", pkgname:"netpbm", pkgver:"10.0-5ubuntu0.3")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"libnetpbm10", pkgver:"10.0-8ubuntu0.3")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"libnetpbm10-dev", pkgver:"10.0-8ubuntu0.3")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"libnetpbm9", pkgver:"10.0-8ubuntu0.3")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"libnetpbm9-dev", pkgver:"10.0-8ubuntu0.3")) flag++;
    if (ubuntu_check(osver:"5.04", pkgname:"netpbm", pkgver:"10.0-8ubuntu0.3")) flag++;
    if (ubuntu_check(osver:"5.10", pkgname:"libnetpbm10", pkgver:"10.0-8ubuntu1.2")) flag++;
    if (ubuntu_check(osver:"5.10", pkgname:"libnetpbm10-dev", pkgver:"10.0-8ubuntu1.2")) flag++;
    if (ubuntu_check(osver:"5.10", pkgname:"libnetpbm9", pkgver:"10.0-8ubuntu1.2")) flag++;
    if (ubuntu_check(osver:"5.10", pkgname:"libnetpbm9-dev", pkgver:"10.0-8ubuntu1.2")) flag++;
    if (ubuntu_check(osver:"5.10", pkgname:"netpbm", pkgver:"10.0-8ubuntu1.2")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libnetpbm10 / libnetpbm10-dev / libnetpbm9 / libnetpbm9-dev / etc");
    }
    

Oval

accepted2013-04-29T04:20:26.391-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationSCAP.com, LLC
  • nameDragos Prisaca
    organizationG2, Inc.
definition_extensions
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
    ovaloval:org.mitre.oval:def:11782
  • commentCentOS Linux 3.x
    ovaloval:org.mitre.oval:def:16651
descriptionOff-by-one buffer overflow in pnmtopng before 2.39, when using the -alpha command line option (Alphas_Of_Color), allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PNM file with exactly 256 colors.
familyunix
idoval:org.mitre.oval:def:9583
statusaccepted
submitted2010-07-09T03:56:16-04:00
titleOff-by-one buffer overflow in pnmtopng before 2.39, when using the -alpha command line option (Alphas_Of_Color), allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PNM file with exactly 256 colors.
version26

Redhat

advisories
rhsa
idRHSA-2005:843
rpms
  • netpbm-0:9.24-11.30.4
  • netpbm-debuginfo-0:9.24-11.30.4
  • netpbm-devel-0:9.24-11.30.4
  • netpbm-progs-0:9.24-11.30.4