{"id": "CVE-2009-1144", "bulletinFamily": "NVD", "title": "CVE-2009-1144", "description": "Untrusted search path vulnerability in the Gentoo package of Xpdf before 3.02-r2 allows local users to gain privileges via a Trojan horse xpdfrc file in the current working directory, related to an unset SYSTEM_XPDFRC macro in a Gentoo build process that uses the poppler library.", "published": "2009-04-09T15:08:00", "modified": "2019-03-06T16:30:00", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1144", "reporter": "cve@mitre.org", "references": ["http://secunia.com/advisories/34610", "http://bugs.gentoo.org/show_bug.cgi?id=242930", "http://bugs.gentoo.org/show_bug.cgi?id=200023", "http://security.gentoo.org/glsa/glsa-200904-07.xml", "http://www.securityfocus.com/bid/34401", "http://osvdb.org/53529"], "cvelist": ["CVE-2009-1144"], "type": "cve", "lastseen": "2019-05-29T18:09:58", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "9e8e06ddd058208bb00655746874dcce"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "fb4258917215ae28e88cf0aeba27336f"}, {"key": "cpe23", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvelist", "hash": "5a9a12b84450ffcbc127c6937ed2b2a1"}, {"key": "cvss", "hash": "d5f1840e27443eb2d6a17b941080264e"}, {"key": "cvss2", "hash": "9b4622bfbf405812753cb3464ff58858"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "697763cf5916ecb521e5a8e56e23f6d3"}, {"key": "description", "hash": "5e364c2c52e070fb1fcb9c5062fb228e"}, {"key": "href", "hash": "de92fd9bd0edd51c9283ca872ac931ce"}, {"key": "modified", "hash": "04bee666d6f68c18976320be1c9da1a2"}, {"key": "published", "hash": "574cdbaad56671ec2eb60a12aa7d5322"}, {"key": "references", "hash": "b0400c9382fedec276c20bdceccd2bd2"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "51f763185619281c51fe90c4c3cb6682"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "dc1fe45b7299756f495cc9944ef95cf7e52761467043f0a50b60a4b54db657c8", "viewCount": 0, "enchantments": {"score": {"value": 6.8, "vector": "NONE", "modified": "2019-05-29T18:09:58"}, "dependencies": {"references": [{"type": "openvas", "idList": ["OPENVAS:136141256231063801", "OPENVAS:63801"]}, {"type": "gentoo", "idList": ["GLSA-200904-07"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:9804", "SECURITYVULNS:DOC:21599"]}, {"type": "nessus", "idList": ["GENTOO_GLSA-200904-07.NASL"]}], "modified": "2019-05-29T18:09:58"}, "vulnersScore": 6.8}, "objectVersion": "1.3", "cpe": ["cpe:/a:glyphandcog:xpdfreader:0.4", "cpe:/a:foolabs:xpdf:0.91c", "cpe:/a:foolabs:xpdf:0.92a", "cpe:/a:foolabs:xpdf:0.91b", "cpe:/a:foolabs:xpdf:1.00a", "cpe:/a:glyphandcog:xpdfreader:0.3", "cpe:/a:glyphandcog:xpdfreader:0.6", "cpe:/a:glyphandcog:xpdfreader:0.91", "cpe:/a:glyphandcog:xpdfreader:0.5", "cpe:/a:foolabs:xpdf:0.92b", "cpe:/a:foolabs:xpdf:0.93b", "cpe:/a:glyphandcog:xpdfreader:0.93", "cpe:/a:foolabs:xpdf:0.91a", "cpe:/a:glyphandcog:xpdfreader:0.7", "cpe:/a:glyphandcog:xpdfreader:2.01", "cpe:/a:glyphandcog:xpdfreader:1.00", "cpe:/a:glyphandcog:xpdfreader:2.03", "cpe:/a:foolabs:xpdf:0.93c", "cpe:/a:foolabs:xpdf:0.92c", "cpe:/a:glyphandcog:xpdfreader:2.02", "cpe:/a:glyphandcog:xpdfreader:2.00", "cpe:/a:foolabs:xpdf:0.93a", "cpe:/a:foolabs:xpdf:0.92e", "cpe:/a:foolabs:xpdf:0.92d", "cpe:/a:foolabs:xpdf:0.7a", "cpe:/a:glyphandcog:xpdfreader:0.80", "cpe:/a:glyphandcog:xpdfreader:1.01", "cpe:/a:glyphandcog:xpdfreader:3.00", "cpe:/a:glyphandcog:xpdfreader:0.90", "cpe:/a:foolabs:xpdf:0.5a", "cpe:/a:glyphandcog:xpdfreader:0.2"], "affectedSoftware": [{"name": "glyphandcog xpdfreader", "operator": "eq", "version": "0.90"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.93b"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "2.02"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "0.7"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "0.4"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.91b"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.91a"}, {"name": "foolabs xpdf", "operator": "eq", "version": "1.00a"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.5a"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "0.91"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.7a"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.92a"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.92c"}, {"name": "glyphandcog xpdfreader", "operator": "le", "version": "3.02"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "0.80"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "0.6"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.93a"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.93c"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "2.01"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.92d"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "0.93"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "0.3"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "0.2"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.92e"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "3.00"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "1.01"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "2.00"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.91c"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "0.5"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "1.00"}, {"name": "foolabs xpdf", "operator": "eq", "version": "0.92b"}, {"name": "glyphandcog xpdfreader", "operator": "eq", "version": "2.03"}], "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {}, "cpe23": [], "cwe": ["CWE-94"]}

{"openvas": [{"lastseen": "2018-04-06T11:39:58", "bulletinFamily": "scanner", "description": "The remote host is missing updates announced in\nadvisory GLSA 200904-07.", "modified": "2018-04-06T00:00:00", "published": "2009-04-15T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231063801", "id": "OPENVAS:136141256231063801", "title": "Gentoo Security Advisory GLSA 200904-07 (xpdf)", "type": "openvas", "sourceData": "#\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability in Xpdf might allow local attackers to execute arbitrary\ncode.\";\ntag_solution = \"All Xpdf users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=app-text/xpdf-3.02-r2'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200904-07\nhttp://bugs.gentoo.org/show_bug.cgi?id=242930\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200904-07.\";\n\n \n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.63801\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-15 22:11:00 +0200 (Wed, 15 Apr 2009)\");\n script_cve_id(\"CVE-2009-1144\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"Gentoo Security Advisory GLSA 200904-07 (xpdf)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"app-text/xpdf\", unaffected: make_list(\"ge 3.02-r2\"), vulnerable: make_list(\"lt 3.02-r2\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:57:00", "bulletinFamily": "scanner", "description": "The remote host is missing updates announced in\nadvisory GLSA 200904-07.", "modified": "2017-07-07T00:00:00", "published": "2009-04-15T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=63801", "id": "OPENVAS:63801", "title": "Gentoo Security Advisory GLSA 200904-07 (xpdf)", "type": "openvas", "sourceData": "#\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability in Xpdf might allow local attackers to execute arbitrary\ncode.\";\ntag_solution = \"All Xpdf users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=app-text/xpdf-3.02-r2'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200904-07\nhttp://bugs.gentoo.org/show_bug.cgi?id=242930\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200904-07.\";\n\n \n \n\nif(description)\n{\n script_id(63801);\n script_version(\"$Revision: 6595 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:19:55 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-15 22:11:00 +0200 (Wed, 15 Apr 2009)\");\n script_cve_id(\"CVE-2009-1144\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"Gentoo Security Advisory GLSA 200904-07 (xpdf)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"app-text/xpdf\", unaffected: make_list(\"ge 3.02-r2\"), vulnerable: make_list(\"lt 3.02-r2\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:44", "bulletinFamily": "unix", "description": "### Background\n\nXpdf is a PDF file viewer that runs under the X Window System. \n\n### Description\n\nErik Wallin reported that Gentoo's Xpdf attempts to read the \"xpdfrc\" file from the current working directory if it cannot find a \".xpdfrc\" file in the user's home directory. This is caused by a missing definition of the SYSTEM_XPDFRC macro when compiling a repackaged version of Xpdf. \n\n### Impact\n\nA local attacker could entice a user to run \"xpdf\" from a directory containing a specially crafted \"xpdfrc\" file, resulting in the execution of arbitrary code when attempting to, e.g., print a file. \n\n### Workaround\n\nDo not run Xpdf from untrusted working directories. \n\n### Resolution\n\nAll Xpdf users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-text/xpdf-3.02-r2\"", "modified": "2009-04-07T00:00:00", "published": "2009-04-07T00:00:00", "id": "GLSA-200904-07", "href": "https://security.gentoo.org/glsa/200904-07", "type": "gentoo", "title": "Xpdf: Untrusted search path", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:32", "bulletinFamily": "software", "description": "xpdfrc file from current location may be processed.", "modified": "2009-04-08T00:00:00", "published": "2009-04-08T00:00:00", "id": "SECURITYVULNS:VULN:9804", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:9804", "title": "xpdf code execution", "type": "securityvulns", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:29", "bulletinFamily": "software", "description": "- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\nGentoo Linux Security Advisory GLSA 200904-07\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n http://security.gentoo.org/\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n\r\n Severity: Normal\r\n Title: Xpdf: Untrusted search path\r\n Date: April 07, 2009\r\n Bugs: #242930\r\n ID: 200904-07\r\n\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n\r\nSynopsis\r\n========\r\n\r\nA vulnerability in Xpdf might allow local attackers to execute\r\narbitrary code.\r\n\r\nBackground\r\n==========\r\n\r\nXpdf is a PDF file viewer that runs under the X Window System.\r\n\r\nAffected packages\r\n=================\r\n\r\n -------------------------------------------------------------------\r\n Package / Vulnerable / Unaffected\r\n -------------------------------------------------------------------\r\n 1 app-text/xpdf &lt; 3.02-r2 &gt;= 3.02-r2\r\n\r\nDescription\r\n===========\r\n\r\nErik Wallin reported that Gentoo&#39;s Xpdf attempts to read the &quot;xpdfrc&quot;\r\nfile from the current working directory if it cannot find a &quot;.xpdfrc&quot;\r\nfile in the user&#39;s home directory. This is caused by a missing\r\ndefinition of the SYSTEM_XPDFRC macro when compiling a repackaged\r\nversion of Xpdf.\r\n\r\nImpact\r\n======\r\n\r\nA local attacker could entice a user to run &quot;xpdf&quot; from a directory\r\ncontaining a specially crafted &quot;xpdfrc&quot; file, resulting in the\r\nexecution of arbitrary code when attempting to, e.g., print a file.\r\n\r\nWorkaround\r\n==========\r\n\r\nDo not run Xpdf from untrusted working directories.\r\n\r\nResolution\r\n==========\r\n\r\nAll Xpdf users should upgrade to the latest version:\r\n\r\n # emerge --sync\r\n # emerge --ask --oneshot --verbose &quot;&gt;=app-text/xpdf-3.02-r2&quot;\r\n\r\nReferences\r\n==========\r\n\r\n [ 1 ] CVE-2009-1144\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1144\r\n\r\nAvailability\r\n============\r\n\r\nThis GLSA and any updates to it are available for viewing at\r\nthe Gentoo Security Website:\r\n\r\n http://security.gentoo.org/glsa/glsa-200904-07.xml\r\n\r\nConcerns?\r\n=========\r\n\r\nSecurity is a primary focus of Gentoo Linux and ensuring the\r\nconfidentiality and security of our users machines is of utmost\r\nimportance to us. Any security concerns should be addressed to\r\nsecurity@gentoo.org or alternatively, you may file a bug at\r\nhttp://bugs.gentoo.org.\r\n\r\nLicense\r\n=======\r\n\r\nCopyright 2009 Gentoo Foundation, Inc; referenced text\r\nbelongs to its owner&#40;s&#41;.\r\n\r\nThe contents of this document are licensed under the\r\nCreative Commons - Attribution / Share Alike license.\r\n\r\nhttp://creativecommons.org/licenses/by-sa/2.5", "modified": "2009-04-08T00:00:00", "published": "2009-04-08T00:00:00", "id": "SECURITYVULNS:DOC:21599", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:21599", "title": "[ GLSA 200904-07 ] Xpdf: Untrusted search path", "type": "securityvulns", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2020-02-01T07:54:57", "bulletinFamily": "scanner", "description": "The remote host is affected by the vulnerability described in GLSA-200904-07\n(Xpdf: Untrusted search path)\n\n Erik Wallin reported that Gentoo", "modified": "2020-02-02T00:00:00", "id": "GENTOO_GLSA-200904-07.NASL", "href": "https://www.tenable.com/plugins/nessus/36095", "published": "2009-04-07T00:00:00", "title": "GLSA-200904-07 : Xpdf: Untrusted search path", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200904-07.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(36095);\n script_version(\"1.12\");\n script_cvs_date(\"Date: 2019/08/02 13:32:45\");\n\n script_cve_id(\"CVE-2009-1144\");\n script_xref(name:\"GLSA\", value:\"200904-07\");\n\n script_name(english:\"GLSA-200904-07 : Xpdf: Untrusted search path\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200904-07\n(Xpdf: Untrusted search path)\n\n Erik Wallin reported that Gentoo's Xpdf attempts to read the 'xpdfrc'\n file from the current working directory if it cannot find a '.xpdfrc'\n file in the user's home directory. This is caused by a missing\n definition of the SYSTEM_XPDFRC macro when compiling a repackaged\n version of Xpdf.\n \nImpact :\n\n A local attacker could entice a user to run 'xpdf' from a directory\n containing a specially crafted 'xpdfrc' file, resulting in the\n execution of arbitrary code when attempting to, e.g., print a file.\n \nWorkaround :\n\n Do not run Xpdf from untrusted working directories.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200904-07\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Xpdf users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=app-text/xpdf-3.02-r2'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_cwe_id(94);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:xpdf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/04/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/04/07\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"app-text/xpdf\", unaffected:make_list(\"ge 3.02-r2\"), vulnerable:make_list(\"lt 3.02-r2\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Xpdf\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}]}