PT-2001-1006 · Xli+3 · Xli+3

Tavis Ormandy · Published 2001-04-17 · Updated 2018-10-19 · CVE-2005-0638

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xloadimage versions prior to 4.1-r2 xli versions prior to 1.17

Description The issue allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images. This is due to the filenames not being properly quoted when calling the gunzip command. Multiple vulnerabilities in the xli package may lead to a breach of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For xloadimage versions prior to 4.1-r2, update to version 4.1-r2 or later. For xli versions prior to 1.17, update to version 1.17 or later. As a temporary workaround, consider restricting the use of the gunzip command with untrusted input until a patch is available. Avoid using the xloadimage and xli packages with compressed images from untrusted sources until the issue is resolved.

Fix

Related Identifiers

BDU:2015-02562

CVE-2005-0638

DSA-694-1

DSA-695-1

RHSA-2005:332

RHSA-2005_332

Affected Products

Red Hat

Gunzip

Xli

Xloadimage

References · 22

• http://securityfocus.com/archive/1/433935/30/5010/threaded · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0638 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-0638 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-0638 · Vendor Advisory
• http://debian.org/security/2005/dsa-695 · Vendor Advisory
• http://secunia.com/advisories/14462 · Vendor Advisory
• http://bugs.gentoo.org/show_bug.cgi?id=79762 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0638 · Security Note
• http://secunia.com/advisories/14459 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02562 · Security Note
• https://osv.dev/vulnerability/CVE-2005-0638 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-332.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0639 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0775 · Security Note
• http://security.gentoo.org/glsa/glsa-200503-05.xml · Vendor Advisory