Vulnerabilities > CVE-2007-2956
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Stack-based buffer overflow in the readRadianceHeader function in (1) src/fileformat/rgbeio.cpp in pfstools 1.6.2 and (2) src/Fileformat/rgbeio.cpp in Qtpfsgui 1.8.11 allows remote attackers to execute arbitrary code via a crafted Radiance RGBE (.hdr) file.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 1 | |
Application | 1 |
Nessus
NASL family Fedora Local Security Checks NASL id FEDORA_2007-1581.NASL description - Sun Aug 12 2007 Douglas E. Warner <silfreed at silfreed.net> 1.8.12-1 - update to version 1.8.12 - fixes CVE-2007-2956; bug#251674 - Thu Aug 2 2007 Douglas E. Warner <silfreed at silfreed.net> 1.8.11-2 - updated License from GPL to GPLv2+ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 27722 published 2007-11-06 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27722 title Fedora 7 : qtpfsgui-1.8.12-1.fc7 (2007-1581) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory 2007-1581. # include("compat.inc"); if (description) { script_id(27722); script_version ("1.12"); script_cvs_date("Date: 2019/08/02 13:32:25"); script_xref(name:"FEDORA", value:"2007-1581"); script_name(english:"Fedora 7 : qtpfsgui-1.8.12-1.fc7 (2007-1581)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: " - Sun Aug 12 2007 Douglas E. Warner <silfreed at silfreed.net> 1.8.12-1 - update to version 1.8.12 - fixes CVE-2007-2956; bug#251674 - Thu Aug 2 2007 Douglas E. Warner <silfreed at silfreed.net> 1.8.11-2 - updated License from GPL to GPLv2+ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); # https://lists.fedoraproject.org/pipermail/package-announce/2007-August/003208.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?ab28c961" ); script_set_attribute( attribute:"solution", value:"Update the affected qtpfsgui and / or qtpfsgui-debuginfo packages." ); script_set_attribute(attribute:"risk_factor", value:"High"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:qtpfsgui"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:qtpfsgui-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:7"); script_set_attribute(attribute:"patch_publication_date", value:"2007/08/13"); script_set_attribute(attribute:"plugin_publication_date", value:"2007/11/06"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! ereg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 7.x", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC7", reference:"qtpfsgui-1.8.12-1.fc7")) flag++; if (rpm_check(release:"FC7", reference:"qtpfsgui-debuginfo-1.8.12-1.fc7")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "qtpfsgui / qtpfsgui-debuginfo"); }
NASL family SuSE Local Security Checks NASL id SUSE_PFSTOOLS-4083.NASL description A buffer overflow when processing RGBE file could potentially allow attackers to execute arbitrary code by tricking the victim into running last seen 2020-06-01 modified 2020-06-02 plugin id 27388 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27388 title openSUSE 10 Security Update : pfstools (pfstools-4083) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update pfstools-4083. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(27388); script_version ("1.12"); script_cvs_date("Date: 2019/10/25 13:36:30"); script_cve_id("CVE-2007-2956"); script_name(english:"openSUSE 10 Security Update : pfstools (pfstools-4083)"); script_summary(english:"Check for the pfstools-4083 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "A buffer overflow when processing RGBE file could potentially allow attackers to execute arbitrary code by tricking the victim into running 'pfsinrgbe' on a specially crafted file (CVE-2007-2956)." ); script_set_attribute( attribute:"solution", value:"Update the affected pfstools package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:pfstools"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.2"); script_set_attribute(attribute:"patch_publication_date", value:"2007/08/14"); script_set_attribute(attribute:"plugin_publication_date", value:"2007/10/17"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE10\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.2", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE10.2", reference:"pfstools-1.5-47.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "pfstools"); }
References
- http://pfstools.cvs.sourceforge.net/pfstools/pfstools/src/fileformat/rgbeio.cpp?r1=1.8&r2=1.9
- http://pfstools.cvs.sourceforge.net/pfstools/pfstools/src/fileformat/rgbeio.cpp?revision=1.9&view=markup
- http://secunia.com/advisories/26387
- http://secunia.com/advisories/26388
- http://secunia.com/advisories/26674
- http://secunia.com/secunia_research/2007-67/advisory/
- http://secunia.com/secunia_research/2007-68/advisory/
- http://umn.dl.sourceforge.net/sourceforge/qtpfsgui/qtpfsgui-1.8.12.tar.gz
- http://www.novell.com/linux/security/advisories/2007_18_sr.html
- http://www.vupen.com/english/advisories/2007/2855
- http://www.vupen.com/english/advisories/2007/2856
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35948
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35949