Vulnerabilities > CVE-2017-12595 - Improper Input Validation vulnerability in Qpdf Project Qpdf 6.0.0/7.0.B1

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
qpdf-project
CWE-20
nessus
NVD
Published: 2017-08-27
Updated: 2018-05-08

Summary

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption and segmentation fault) or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash in QPDFObjectHandle::parseInternal in libqpdf/QPDFObjectHandle.cc.

Vulnerable Configurations

Part Description Count
Application
Qpdf_Project
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Server Side Include (SSI) Injection
    An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
  • Cross Zone Scripting
    An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-3066-2.NASL
    descriptionThis update for qpdf fixes the following issues : qpdf was updated to 7.1.1. Security issues fixed : CVE-2017-11627: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050577). CVE-2017-11625: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050579). CVE-2017-11626: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050578). CVE-2017-11624: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050581). CVE-2017-12595: Stack overflow when processing deeply nested arrays and dictionaries (bsc#1055960). CVE-2017-9209: Remote attackers can cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document (bsc#1040312). CVE-2017-9210: Remote attackers can cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document (bsc#1040313). CVE-2017-9208: Remote attackers can cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document (bsc#1040311). - Check release notes for detailed bug fixes. - http://qpdf.sourceforge.net/files/qpdf-manual.html#ref.release-notes Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id118301
    published2018-10-22
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118301
    titleSUSE SLES12 Security Update : qpdf (SUSE-SU-2018:3066-2)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2018:3066-2.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(118301);
  script_version("1.3");
  script_cvs_date("Date: 2019/09/10 13:51:49");

  script_cve_id("CVE-2017-11624", "CVE-2017-11625", "CVE-2017-11626", "CVE-2017-11627", "CVE-2017-12595", "CVE-2017-9208", "CVE-2017-9209", "CVE-2017-9210");

  script_name(english:"SUSE SLES12 Security Update : qpdf (SUSE-SU-2018:3066-2)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for qpdf fixes the following issues :

qpdf was updated to 7.1.1.

Security issues fixed :

CVE-2017-11627: A stack-consumption vulnerability which allows
attackers to cause DoS (bsc#1050577).

CVE-2017-11625: A stack-consumption vulnerability which allows
attackers to cause DoS (bsc#1050579).

CVE-2017-11626: A stack-consumption vulnerability which allows
attackers to cause DoS (bsc#1050578).

CVE-2017-11624: A stack-consumption vulnerability which allows
attackers to cause DoS (bsc#1050581).

CVE-2017-12595: Stack overflow when processing deeply nested arrays
and dictionaries (bsc#1055960).

CVE-2017-9209: Remote attackers can cause a denial of service
(infinite recursion and stack consumption) via a crafted PDF document
(bsc#1040312).

CVE-2017-9210: Remote attackers can cause a denial of service
(infinite recursion and stack consumption) via a crafted PDF document
(bsc#1040313).

CVE-2017-9208: Remote attackers can cause a denial of service
(infinite recursion and stack consumption) via a crafted PDF document
(bsc#1040311).

  - Check release notes for detailed bug fixes.

  - http://qpdf.sourceforge.net/files/qpdf-manual.html#ref.release-notes

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://qpdf.sourceforge.net/files/qpdf-manual.html#ref.release-notes"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1040311"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1040312"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1040313"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1050577"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1050578"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1050579"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1050581"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1055960"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-11624/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-11625/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-11626/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-11627/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-12595/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-9208/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-9209/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-9210/"
  );
  # https://www.suse.com/support/update/announcement/2018/suse-su-20183066-2/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?4cb84123"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch
SUSE-SLE-SERVER-12-SP2-BCL-2018-2169=1"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-cups-browsed");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-cups-browsed-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-foomatic-rip");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-foomatic-rip-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-ghostscript");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-ghostscript-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libqpdf18");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libqpdf18-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:qpdf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:qpdf-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:qpdf-debugsource");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/05/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/10/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/10/22");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES12", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
if (cpu >!< "x86_64") audit(AUDIT_ARCH_NOT, "x86_64", cpu);


sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES12" && (! preg(pattern:"^(2)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP2", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"cups-filters-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"cups-filters-cups-browsed-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"cups-filters-cups-browsed-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"cups-filters-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"cups-filters-debugsource-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"cups-filters-foomatic-rip-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"cups-filters-foomatic-rip-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"cups-filters-ghostscript-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"cups-filters-ghostscript-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libqpdf18-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libqpdf18-debuginfo-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"qpdf-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"qpdf-debuginfo-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"qpdf-debugsource-7.1.1-3.3.4")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "qpdf");
}
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-F2E1C09437.NASL
    descriptionRebase to qpdf-7.1.1 because of security fixes for CVE-2018-9918, CVE-2017-11627, CVE-2017-12595. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2018-05-01
    plugin id109436
    published2018-05-01
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109436
    titleFedora 27 : cups-filters / qpdf (2018-f2e1c09437)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory FEDORA-2018-f2e1c09437.
#

include("compat.inc");

if (description)
{
  script_id(109436);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2017-11627", "CVE-2017-12595", "CVE-2018-9918");
  script_xref(name:"FEDORA", value:"2018-f2e1c09437");

  script_name(english:"Fedora 27 : cups-filters / qpdf (2018-f2e1c09437)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Rebase to qpdf-7.1.1 because of security fixes for CVE-2018-9918,
CVE-2017-11627, CVE-2017-12595.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bodhi.fedoraproject.org/updates/FEDORA-2018-f2e1c09437"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected cups-filters and / or qpdf packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:cups-filters");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:qpdf");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:27");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/07/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/04/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/01");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^27([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 27", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);


flag = 0;
if (rpm_check(release:"FC27", reference:"cups-filters-1.16.1-5.fc27")) flag++;
if (rpm_check(release:"FC27", reference:"qpdf-7.1.1-5.fc27")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "cups-filters / qpdf");
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-3066-1.NASL
    descriptionThis update for qpdf fixes the following issues : qpdf was updated to 7.1.1. Security issues fixed : CVE-2017-11627: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050577). CVE-2017-11625: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050579). CVE-2017-11626: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050578). CVE-2017-11624: A stack-consumption vulnerability which allows attackers to cause DoS (bsc#1050581). CVE-2017-12595: Stack overflow when processing deeply nested arrays and dictionaries (bsc#1055960). CVE-2017-9209: Remote attackers can cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document (bsc#1040312). CVE-2017-9210: Remote attackers can cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document (bsc#1040313). CVE-2017-9208: Remote attackers can cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document (bsc#1040311). - Check release notes for detailed bug fixes. - http://qpdf.sourceforge.net/files/qpdf-manual.html#ref.release-notes Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id117993
    published2018-10-09
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/117993
    titleSUSE SLED12 / SLES12 Security Update : qpdf (SUSE-SU-2018:3066-1)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2018:3066-1.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(117993);
  script_version("1.3");
  script_cvs_date("Date: 2019/09/10 13:51:49");

  script_cve_id("CVE-2017-11624", "CVE-2017-11625", "CVE-2017-11626", "CVE-2017-11627", "CVE-2017-12595", "CVE-2017-9208", "CVE-2017-9209", "CVE-2017-9210");

  script_name(english:"SUSE SLED12 / SLES12 Security Update : qpdf (SUSE-SU-2018:3066-1)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for qpdf fixes the following issues :

qpdf was updated to 7.1.1.

Security issues fixed :

CVE-2017-11627: A stack-consumption vulnerability which allows
attackers to cause DoS (bsc#1050577).

CVE-2017-11625: A stack-consumption vulnerability which allows
attackers to cause DoS (bsc#1050579).

CVE-2017-11626: A stack-consumption vulnerability which allows
attackers to cause DoS (bsc#1050578).

CVE-2017-11624: A stack-consumption vulnerability which allows
attackers to cause DoS (bsc#1050581).

CVE-2017-12595: Stack overflow when processing deeply nested arrays
and dictionaries (bsc#1055960).

CVE-2017-9209: Remote attackers can cause a denial of service
(infinite recursion and stack consumption) via a crafted PDF document
(bsc#1040312).

CVE-2017-9210: Remote attackers can cause a denial of service
(infinite recursion and stack consumption) via a crafted PDF document
(bsc#1040313).

CVE-2017-9208: Remote attackers can cause a denial of service
(infinite recursion and stack consumption) via a crafted PDF document
(bsc#1040311).

  - Check release notes for detailed bug fixes.

  - http://qpdf.sourceforge.net/files/qpdf-manual.html#ref.release-notes

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://qpdf.sourceforge.net/files/qpdf-manual.html#ref.release-notes"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1040311"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1040312"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1040313"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1050577"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1050578"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1050579"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1050581"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1055960"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-11624/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-11625/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-11626/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-11627/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-12595/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-9208/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-9209/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2017-9210/"
  );
  # https://www.suse.com/support/update/announcement/2018/suse-su-20183066-1/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?787b25b4"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE OpenStack Cloud 7:zypper in -t patch
SUSE-OpenStack-Cloud-7-2018-2169=1

SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t
patch SUSE-SLE-SDK-12-SP3-2018-2169=1

SUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch
SUSE-SLE-SAP-12-SP2-2018-2169=1

SUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch
SUSE-SLE-SAP-12-SP1-2018-2169=1

SUSE Linux Enterprise Server 12-SP3:zypper in -t patch
SUSE-SLE-SERVER-12-SP3-2018-2169=1

SUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP2-2018-2169=1

SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-SP1-2018-2169=1

SUSE Linux Enterprise Server 12-LTSS:zypper in -t patch
SUSE-SLE-SERVER-12-2018-2169=1

SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch
SUSE-SLE-DESKTOP-12-SP3-2018-2169=1

SUSE Enterprise Storage 4:zypper in -t patch
SUSE-Storage-4-2018-2169=1"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-cups-browsed");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-cups-browsed-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-foomatic-rip");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-foomatic-rip-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-ghostscript");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:cups-filters-ghostscript-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libqpdf18");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libqpdf18-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:qpdf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:qpdf-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:qpdf-debugsource");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/05/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/10/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/10/09");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES12" && (! preg(pattern:"^(0|1|2|3)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP0/1/2/3", os_ver + " SP" + sp);
if (os_ver == "SLED12" && (! preg(pattern:"^(3)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP3", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES12", sp:"1", reference:"cups-filters-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"cups-filters-cups-browsed-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"cups-filters-cups-browsed-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"cups-filters-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"cups-filters-debugsource-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"cups-filters-foomatic-rip-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"cups-filters-foomatic-rip-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"cups-filters-ghostscript-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"cups-filters-ghostscript-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"libqpdf18-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"libqpdf18-debuginfo-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"qpdf-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"qpdf-debuginfo-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"1", reference:"qpdf-debugsource-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"cups-filters-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"cups-filters-cups-browsed-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"cups-filters-cups-browsed-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"cups-filters-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"cups-filters-debugsource-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"cups-filters-foomatic-rip-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"cups-filters-foomatic-rip-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"cups-filters-ghostscript-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"cups-filters-ghostscript-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"libqpdf18-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"libqpdf18-debuginfo-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"qpdf-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"qpdf-debuginfo-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"qpdf-debugsource-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"cups-filters-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"cups-filters-cups-browsed-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"cups-filters-cups-browsed-debuginfo-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"cups-filters-debuginfo-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"cups-filters-debugsource-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"cups-filters-foomatic-rip-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"cups-filters-foomatic-rip-debuginfo-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"cups-filters-ghostscript-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"cups-filters-ghostscript-debuginfo-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libqpdf18-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"libqpdf18-debuginfo-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"qpdf-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"qpdf-debuginfo-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"3", reference:"qpdf-debugsource-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"cups-filters-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"cups-filters-cups-browsed-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"cups-filters-cups-browsed-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"cups-filters-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"cups-filters-debugsource-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"cups-filters-foomatic-rip-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"cups-filters-foomatic-rip-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"cups-filters-ghostscript-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"cups-filters-ghostscript-debuginfo-1.0.58-15.2.1")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libqpdf18-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"libqpdf18-debuginfo-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"qpdf-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"qpdf-debuginfo-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLES12", sp:"2", reference:"qpdf-debugsource-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"cups-filters-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"cups-filters-cups-browsed-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"cups-filters-cups-browsed-debuginfo-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"cups-filters-debuginfo-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"cups-filters-debugsource-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"cups-filters-foomatic-rip-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"cups-filters-foomatic-rip-debuginfo-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"cups-filters-ghostscript-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"cups-filters-ghostscript-debuginfo-1.0.58-19.2.3")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libqpdf18-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libqpdf18-debuginfo-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"qpdf-debuginfo-7.1.1-3.3.4")) flag++;
if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"qpdf-debugsource-7.1.1-3.3.4")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "qpdf");
}
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-176.NASL
    descriptionThis version update for qpdf to 7.1.1 fixes the following issues : - Update to version 7.1.1 - Fix one linearization bug affecting files whose first /ID component is not 16 bytes long - Update to version 7.1.0 - Allow raw encryption key to be specified in libary and command line with the QPDF::setPasswordIsHexKey method and --password-is-hex-key option. Allow encryption key to be displayed with --show-encryption-key option. See https://blog.didierstevens.com/2017/12/28/cracking-encry pted-pdfs-part-3/ for a discussion of using this for cracking encrypted PDFs. I hope that a future release of qpdf will include some additional recovery options that may also make use of this capability. - Fix lexical error: the PDF specification allows floating point numbers to end with
    last seen2020-06-05
    modified2018-02-20
    plugin id106894
    published2018-02-20
    reporterThis script is Copyright (C) 2018-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/106894
    titleopenSUSE Security Update : qpdf (openSUSE-2018-176)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2018-176.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(106894);
  script_version("3.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2017-11624", "CVE-2017-11625", "CVE-2017-11626", "CVE-2017-11627", "CVE-2017-12595", "CVE-2017-9208", "CVE-2017-9209", "CVE-2017-9210");

  script_name(english:"openSUSE Security Update : qpdf (openSUSE-2018-176)");
  script_summary(english:"Check for the openSUSE-2018-176 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This version update for qpdf to 7.1.1 fixes the following issues :

  - Update to version 7.1.1

  - Fix one linearization bug affecting files whose first
    /ID component is not 16 bytes long

  - Update to version 7.1.0

  - Allow raw encryption key to be specified in libary and
    command line with the QPDF::setPasswordIsHexKey method
    and

    --password-is-hex-key option. Allow encryption key to be
    displayed with --show-encryption-key option. See
    https://blog.didierstevens.com/2017/12/28/cracking-encry
    pted-pdfs-part-3/ for a discussion of using this for
    cracking encrypted PDFs. I hope that a future release of
    qpdf will include some additional recovery options that
    may also make use of this capability.

  - Fix lexical error: the PDF specification allows floating
    point numbers to end with '.'

  - Fix link order in the build to avoid conflicts when
    building from source while an older version of qpdf is
    installed

  - Add support for TIFF predictor for LZW and Flate
    streams. Now

  - Clarify documentation around options that control
    parsing but not output creation. Two options:
    --suppress-recovery and

    --ignore-xref-streams, were documented in the 'Advanced
    Transformation Options' section of the manual and --help
    output even though they are not related to output. These
    are now described in a separate section called 'Advanced
    Parsing Options.'

  - Implement remaining PNG filters for decode. Prior
    versions could decode only the 'up' filter. Now all PNG
    filters (sub, up, average, Paeth, optimal) are supported
    for decoding. The implementation of the remaining PNG
    filters changed the interface to the private
    Pl_PNGFilter class, but this class's header file is not
    in the installation, and there is no public interface to
    the class. Within the library, the class is never
    allocated on the stack; it is only ever dynamically
    allocated. As such, this does not actually break binary
    compatibility of the library. all predictor functions
    are supported

  - Update to version 7.0.0

  - License is now Apache-2.0

  - Add new libjpeg8-devel dependency

  - Improve the error message that is issued when QPDFWriter
    encounters a stream that can't be decoded. In
    particular, mention that the stream will be copied
    without filtering to avoid data loss.

  - Add new methods to the C API to correspond to new
    additions to QPDFWriter :

    &#9;- qpdf_set_compress_streams

    &#9;- qpdf_set_decode_level

    &#9;- qpdf_set_preserve_unreferenced_objects

    &#9;- qpdf_set_newline_before_endstream

  - Add support for writing PCLm files

  - QPDF now supports reading and writing streams encoded
    with JPEG or RunLength encoding. Library API
    enhancements and command-line options have been added to
    control this behavior. See command-line options
    --compress-streams and --decode-level and methods
    QPDFWriter::setCompressStreams and
    QPDFWriter::setDecodeLevel.

  - Page rotation is now supported and accessible from both
    the library and the command line.

  - Fixes CVE-2017-12595 boo#1055960, CVE-2017-9208
    boo#1040311 CVE-2017-9209 boo#1040312, CVE-2017-9210
    boo#1040313, CVE-2017-11627 boo#1050577, CVE-2017-11626
    boo#1050578, CVE-2017-11625 boo#1050579, CVE-2017-11624
    boo#1050581

  - Update to version 6.0.0

  - Bump shared library version since 5.2.0 broke ABI.

  - Update to version 5.2.0

  - Support for deterministic /IDs for non-encrypted files.
    This is off by default.

  - Handle more invalid xref tables"
  );
  # https://blog.didierstevens.com/2017/12/28/cracking-encrypted-pdfs-part-3/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?70db0b82"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1040311"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1040312"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1040313"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1050577"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1050578"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1050579"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1050581"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1055960"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected qpdf packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters-cups-browsed");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters-cups-browsed-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters-foomatic-rip");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters-foomatic-rip-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters-ghostscript");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:cups-filters-ghostscript-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libqpdf18");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libqpdf18-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:qpdf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:qpdf-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:qpdf-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:qpdf-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3");

  script_set_attribute(attribute:"patch_publication_date", value:"2018/02/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/02/20");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2018-2020 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE42.3", reference:"libqpdf18-7.1.1-6.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"libqpdf18-debuginfo-7.1.1-6.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"qpdf-7.1.1-6.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"qpdf-debuginfo-7.1.1-6.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"qpdf-debugsource-7.1.1-6.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", reference:"qpdf-devel-7.1.1-6.3.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", cpu:"x86_64", reference:"cups-filters-1.8.2-4.2.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", cpu:"x86_64", reference:"cups-filters-cups-browsed-1.8.2-4.2.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", cpu:"x86_64", reference:"cups-filters-cups-browsed-debuginfo-1.8.2-4.2.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", cpu:"x86_64", reference:"cups-filters-debuginfo-1.8.2-4.2.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", cpu:"x86_64", reference:"cups-filters-debugsource-1.8.2-4.2.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", cpu:"x86_64", reference:"cups-filters-devel-1.8.2-4.2.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", cpu:"x86_64", reference:"cups-filters-foomatic-rip-1.8.2-4.2.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", cpu:"x86_64", reference:"cups-filters-foomatic-rip-debuginfo-1.8.2-4.2.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", cpu:"x86_64", reference:"cups-filters-ghostscript-1.8.2-4.2.1") ) flag++;
if ( rpm_check(release:"SUSE42.3", cpu:"x86_64", reference:"cups-filters-ghostscript-debuginfo-1.8.2-4.2.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libqpdf18 / libqpdf18-debuginfo / qpdf / qpdf-debuginfo / etc");
}
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3638-1.NASL
    descriptionIt was discovered that QPDF incorrectly handled certain malformed files. A remote attacker could use this issue to cause QPDF to crash, resulting in a denial of service, or possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id109600
    published2018-05-08
    reporterUbuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109600
    titleUbuntu 14.04 LTS / 16.04 LTS / 17.10 : qpdf vulnerabilities (USN-3638-1)

References