|
|
|
|
| |
Credit:
The information has been provided by Chris Evans and Damien Miller.
The original article can be found at: http://www.ocert.org/advisories/ocert-2009-010.html
|
| |
Vulnerable Systems:
* mimeTeX versions prior to 2009/07/13
* mathTex versions prior to 2009/07/13
Immune Systems:
* mimeTeX subsequent to 2009/07/13
* mathTex subsequent to 2009/07/13
Unfortunately mimeTeX and mathTex are provided without version numbers by the maintainer, who releases version-less zip archives. It is therefore impossible to provide affected version numbers.
The mimeTeX application suffers from several stack-based buffer overflows which can be remotely triggered by passing oversized TeX expressions. Additionally the \environ, \input and \counter directives may not be suitable for exposure to commands from the Internet. Similarly the mathTeX application does not perform sufficient input sanitization and allows untrusted input, passed via HTTP query strings, to be used as command arguments allowing command injection. Additionally it suffers from several stack-based overflows as well as insecure temporary file handling.
CVE Information:
CVE-2009-1382
CVE-2009-1383
Disclosure Timeline:
2009-05-22: vulnerability report received
2009-05-25: contacted mimetex/mathtex maintainer
2009-05-25: maintainer publicly discloses report contents
2009-05-26: contacted affected vendors
2009-05-26: maintainer provides updated packages
2009-05-26: assigned CVEs
2009-05-26: reporters indicate that the updated packages do not fix all the issues
2009-05-29: reporters find additional overflows in updated packages
2009-06-01: maintainer contacted with updated report
2009-07-09: reporters confirm that updated packages fixing the reported issues are available
2009-07-13: advisory release
|
|
|
|
|
