KDE Postscript/PDF文件处理任意命令执行漏洞

漏洞信息详情

KDE Postscript/PDF文件处理任意命令执行漏洞

• CNNVD编号：CNNVD-200305-005
• 危害等级： 高危
  
  
• CVE编号：
  CVE-2003-0204
  
• 漏洞类型：
  
  
  其他
  
• 发布时间：
  
  2003-04-10
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2005-10-20
  
• 厂        商：
  
  kde
• 漏洞来源：
  KDE security advis…

KDE使用Ghostscript软件处理PS和PDF文件。
KDE在处理畸形PDF和PS文件时存在漏洞，远程攻击者可以利用这个漏洞可能以用户进程权限执行任意命令。
攻击者可以准备恶意PostScript或PDF文件，构建恶意WEB页诱使用户点击或EMAIL发送给用户打开，可导致嵌入的命令以用户进程权限执行。目前没有提供详细漏洞细节。

厂商补丁：
Debian
——

http://www.debian.org/security/2003/dsa-284
KDE
—
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

KDE KDE 2.2.2:

KDE Patch post-2.2.2-kdebase-thumbnail.diff

ftp://ftp.kde.org/pub/kde/security_patches/post-2.2.2-kdebase-thumbnail.diff

KDE Patch post-2.2.2-kdegraphics-kdvi.diff

ftp://ftp.kde.org/pub/kde/security_patches/post-2.2.2-kdegraphics-kdvi.diff

KDE Patch post-2.2.2-kdegraphics-kghostview-2.diff

ftp://ftp.kde.org/pub/kde/security_patches/post-2.2.2-kdegraphics-kghostview-2.diff

KDE Patch post-2.2.2-kdelibs-kimgio.diff

ftp://ftp.kde.org/pub/kde/security_patches/post-2.2.2-kdelibs-kimgio.diff

KDE KDE 3.0:

KDE Upgrade KDE 3.0.5b

http://download.kde.org/stable/3.0.5b/” target=”_blank”>
http://download.kde.org/stable/3.0.5b/

KDE KDE 3.0.1:

KDE Upgrade KDE 3.0.5b

http://download.kde.org/stable/3.0.5b/” target=”_blank”>
http://download.kde.org/stable/3.0.5b/

KDE KDE 3.0.2:

KDE Upgrade KDE 3.0.5b

http://download.kde.org/stable/3.0.5b/” target=”_blank”>
http://download.kde.org/stable/3.0.5b/

KDE KDE 3.0.3 a:

KDE Upgrade KDE 3.0.5b

http://download.kde.org/stable/3.0.5b/” target=”_blank”>
http://download.kde.org/stable/3.0.5b/

KDE KDE 3.0.3:

KDE Upgrade KDE 3.0.5b

http://download.kde.org/stable/3.0.5b/” target=”_blank”>
http://download.kde.org/stable/3.0.5b/

KDE KDE 3.0.4:

KDE Upgrade KDE 3.0.5b

http://download.kde.org/stable/3.0.5b/” target=”_blank”>
http://download.kde.org/stable/3.0.5b/

KDE KDE 3.0.5 a:

KDE Patch post-3.0.5a-kdebase-thumbnail.diff

ftp://ftp.kde.org/pub/kde/security_patches/post-3.0.5a-kdebase-thumbnail.diff

KDE Patch post-3.0.5a-kdegraphics-kdvi.diff

ftp://ftp.kde.org/pub/kde/security_patches/post-3.0.5a-kdegraphics-kdvi.diff

KDE Patch post-3.0.5a-kdegraphics-kghostview.diff

ftp://ftp.kde.org/pub/kde/security_patches/post-3.0.5a-kdegraphics-kghostview.diff

KDE Patch post-3.0.5a-kdelibs-kimgio.diff

ftp://ftp.kde.org/pub/kde/security_patches/post-3.0.5a-kdelibs-kimgio.diff

KDE Upgrade KDE 3.0.5b

http://download.kde.org/stable/3.0.5b/” target=”_blank”>
http://download.kde.org/stable/3.0.5b/

KDE KDE 3.1:

KDE Upgrade KDE 3.1.1a

http://download.kde.org/stable/3.1.1a/” target=”_blank”>
http://download.kde.org/stable/3.1.1a/

KDE KDE 3.1.1:

KDE Patch post-3.1.1-kdebase-thumbnail.diff

ftp://ftp.kde.org/pub/kde/security_patches/post-3.1.1-kdebase-thumbnail.diff

KDE Patch post-3.1.1-kdegraphics-kdvi.diff

ftp://ftp.kde.org/pub/kde/security_patches/post-3.1.1-kdegraphics-kdvi.diff

KDE Patch post-3.1.1-kdegraphics-kghostview.diff

ftp://ftp.kde.org/pub/kde/security_patches/post-3.1.1-kdegraphics-kghostview.diff

KDE Patch post-3.1.1-kdelibs-kimgio.diff

ftp://ftp.kde.org/pub/kde/security_patches/post-3.1.1-kdelibs-kimgio.diff

KDE Upgrade KDE 3.1.1a

http://download.kde.org/stable/3.1.1a/” target=”_blank”>
http://download.kde.org/stable/3.1.1a/
MandrakeSoft
————
MandrakeSoft已经为此发布了一个安全公告(MDKSA-2003:049)以及相应补丁:

MDKSA-2003:049：Updated kde3 packages fix arbitrary command execution

链接：http://www.linux-mandrake.com/en/security/2003/2003-049.php” target=”_blank”>
http://www.linux-mandrake.com/en/security/2003/2003-049.php

补丁下载：

Updated Packages:

Corporate Server 2.1:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/kdebase-3.0.5a-1.2mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/kdebase-devel-3.0.5a-1.2mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/kdebase-nsplugins-3.0.5a-1.2mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/kdelibs-3.0.5a-1.2mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/kdelibs-devel-3.0.5a-1.2mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/kdegraphics-3.0.5a-1.2mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/RPMS/kdegraphics-devel-3.0.5a-1.2mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/SRPMS/kdebase-3.0.5a-1.2mdk.src.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/SRPMS/kdelibs-3.0.5a-1.2mdk.src.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/corporate/2.1/SRPMS/kdegraphics-3.0.5a-1.2mdk.src.rpm

Mandrake Linux 9.0:

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/kdebase-3.0.5a-1.2mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/kdebase-devel-3.0.5a-1.2mdk.i586.rpm

ftp://download.sourceforge.net/pub/mirrors/mandrake/updates/9.0/RPMS/kdebase-nsplugins-3.0.5a-1.2mdk.i586.rpm