Rapid7 Vulnerability & Exploit Database

RHSA-2003:061: netpbm security update

Back to Search

RHSA-2003:061: netpbm security update

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
03/31/2003
Created
07/25/2018
Added
10/28/2005
Modified
07/12/2017

Description

Updated NetPBM packages are available that fix a number of vulnerabilities in the netpbm libraries.

The netpbm package contains a library of functions that support programs for handling various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps), and others. During an audit of the NetPBM library, Al Viro, Alan Cox, and Sebastian Krahmer found a number of bugs that are potentially exploitable. These bugs could be exploited by creating a carefully crafted image in such a way that it executes arbitrary code when it is processed by either an application from the netpbm-progs package or an application that uses the vulnerable netpbm library. One way that an attacker could exploit these vulnerabilities would be to submit a carefully crafted image to be printed, as the LPRng print spooler used by default in Red Hat Linux Advanced Products releases uses netpbm utilities to parse various types of image files. Users are advised to upgrade to the updated packages, which contain patches that correct these vulnerabilities.

Solution(s)

  • redhat-upgrade-netpbm
  • redhat-upgrade-netpbm-devel
  • redhat-upgrade-netpbm-progs

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;