Vulnerabilities > CVE-2006-3119 - Unspecified vulnerability in FBI
Attack vector
NETWORK Attack complexity
HIGH Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
The fbgs framebuffer Postscript/PDF viewer in fbi before 2.01 has a typo that prevents a filter from working correctly, which allows user-assisted attackers to bypass the filter and execute malicious Postscript commands.
Nessus
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200608-22.NASL description The remote host is affected by the vulnerability described in GLSA-200608-22 (fbida: Arbitrary command execution) Toth Andras has discovered a typographic mistake in the last seen 2020-06-01 modified 2020-06-02 plugin id 22284 published 2006-08-30 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22284 title GLSA-200608-22 : fbida: Arbitrary command execution code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 200608-22. # # The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(22284); script_version("1.14"); script_cvs_date("Date: 2019/08/02 13:32:43"); script_cve_id("CVE-2006-3119"); script_bugtraq_id(19131); script_xref(name:"GLSA", value:"200608-22"); script_name(english:"GLSA-200608-22 : fbida: Arbitrary command execution"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-200608-22 (fbida: Arbitrary command execution) Toth Andras has discovered a typographic mistake in the 'fbgs' script, shipped with fbida if the 'fbcon' and 'pdf' USE flags are both enabled. This script runs 'gs' without the -dSAFER option, thus allowing a PostScript file to execute, delete or create any kind of file on the system. Impact : A remote attacker can entice a vulnerable user to view a malicious PostScript or PDF file with fbgs, which may result with the execution of arbitrary code. Workaround : There is no known workaround at this time." ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/200608-22" ); script_set_attribute( attribute:"solution", value: "All fbida users with the 'fbcon' and 'pdf' USE flags both enabled should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=media-gfx/fbida-2.03-r4'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:fbida"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2006/08/23"); script_set_attribute(attribute:"plugin_publication_date", value:"2006/08/30"); script_set_attribute(attribute:"vuln_publication_date", value:"2006/07/24"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2006-2019 Tenable Network Security, Inc."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"media-gfx/fbida", unaffected:make_list("ge 2.03-r4"), vulnerable:make_list("lt 2.03-r4"))) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get()); else security_warning(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "fbida"); }
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1124.NASL description Toth Andras discovered that the fbgs framebuffer postscript/PDF viewer contains a typo, which prevents the intended filter against malicious postscript commands from working correctly. This might lead to the deletion of user data when displaying a postscript file. last seen 2020-06-01 modified 2020-06-02 plugin id 22666 published 2006-10-14 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22666 title Debian DSA-1124-1 : fbi - typo NASL family SuSE Local Security Checks NASL id SUSE_FBI-1915.NASL description The fbgs program did not activate security options in the postscript interpreter due to a typo (CVE-2006-3119). fbgs also used a temporary directory with predictable name (CVE-2006-1695). last seen 2020-06-01 modified 2020-06-02 plugin id 27212 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27212 title openSUSE 10 Security Update : fbi (fbi-1915)
References
- http://secunia.com/advisories/21169
- http://secunia.com/advisories/21191
- http://secunia.com/advisories/21459
- http://secunia.com/advisories/21599
- http://security.gentoo.org/glsa/glsa-200608-22.xml
- http://www.debian.org/security/2006/dsa-1124
- http://www.novell.com/linux/security/advisories/2006_19_sr.html
- http://www.securityfocus.com/bid/19131
- http://www.vupen.com/english/advisories/2006/2982
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28038