Exploit the possiblities

Open Source CERT Security Advisory 2009.10

Open Source CERT Security Advisory 2009.10
Posted Jul 14, 2009
Authored by Chris Evans, Damien Miller, Open Source CERT

The mimeTeX and mathTeX CGIs suffer from several buffer overflows as well as command injection which result in remote code execution. Unfortunately mimeTeX and mathTex are provided without version numbers by the maintainer, who releases version-less zip archives. It is therefore impossible to provide affected version numbers.

tags | advisory, remote, overflow, cgi, code execution
advisories | CVE-2009-1382, CVE-2009-1383
MD5 | c7054415cf4b97f427efeec7cef352ed

Open Source CERT Security Advisory 2009.10

Change Mirror Download

#2009-010 mimeTeX and mathTeX buffer overflows and command injection

Description:

The mimeTeX and mathTeX CGIs are widely used helper executables that allow
mathematical equation rendering in the form of images. Both applications suffer
from several buffer overflows as well as command injection which result in
remote code execution.

The mimeTeX application suffers from several stack-based buffer overflows which
can be remotely triggered by passing oversized TeX expressions. Additionally
the \environ, \input and \counter directives may not be suitable for exposure
to commands from the Internet.

Similarly the mathTeX application does not perform sufficient input
sanitization and allows untrusted input, passed via HTTP query strings, to be
used as command arguments allowing command injection. Additionally it suffers
from several stack-based overflows as well as insecure temporary file handling.

Affected version:

Unfortunately mimeTeX and mathTex are provided without version numbers by the
maintainer, who releases version-less zip archives. It is therefore impossible
to provide affected version numbers.

Fixed version:

At the release time for this advisory both versions available on the maintainer
website fix the overflow and injection issues.

mimeTeX, mimetex.zip (2009/07/13)

mathTeX, mathtex.zip (2009/07/13)

Credit: vulnerability report received from Chris Evans <cevans [at] google
[dot] com> (mimetex) and Damien Miller <djm [at] google [dot] com>
(mathtex), Google Security Team.

CVE: CVE-2009-1382 (mimetex), CVE-2009-1383 (mathtex)

Timeline:

2009-05-22: vulnerability report received
2009-05-25: contacted mimetex/mathtex maintainer
2009-05-25: maintainer publicly discloses report contents
2009-05-26: contacted affected vendors
2009-05-26: maintainer provides updated packages
2009-05-26: assigned CVEs
2009-05-26: reporters indicate that the updated packages do not fix all
the issues
2009-05-29: reporters find additional overflows in updated packages
2009-06-01: maintainer contacted with updated report
2009-07-09: reporters confirm that updated packages fixing the reported
issues are available
2009-07-13: advisory release

References:
http://scary.beasts.org/security/CESA-2009-009.html
http://groups.google.com/group/comp.text.tex/browse_thread/thread/5d56d3d744351578

Permalink:
http://www.ocert.org/advisories/ocert-2009-010.html

--
Andrea Barisani | Founder & Project Coordinator
oCERT | Open Source Computer Emergency Response Team

<lcars@ocert.org> http://www.ocert.org
0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
"Pluralitas non est ponenda sine necessitate"

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

January 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    16 Files
  • 4
    Jan 4th
    39 Files
  • 5
    Jan 5th
    26 Files
  • 6
    Jan 6th
    40 Files
  • 7
    Jan 7th
    2 Files
  • 8
    Jan 8th
    16 Files
  • 9
    Jan 9th
    25 Files
  • 10
    Jan 10th
    28 Files
  • 11
    Jan 11th
    44 Files
  • 12
    Jan 12th
    32 Files
  • 13
    Jan 13th
    2 Files
  • 14
    Jan 14th
    4 Files
  • 15
    Jan 15th
    31 Files
  • 16
    Jan 16th
    15 Files
  • 17
    Jan 17th
    16 Files
  • 18
    Jan 18th
    24 Files
  • 19
    Jan 19th
    15 Files
  • 20
    Jan 20th
    5 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close