PT-2007-2106 · Tetex · Makeindex

Mark Richters · Published 2007-02-01 · Updated 2017-07-29 · CVE-2007-0650

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions makeindex version 2.14 in teTeX

Description A buffer overflow issue exists in the open sty function in mkind.c, potentially allowing user-assisted remote attackers to overwrite files and possibly execute arbitrary code via a long filename. Other overflows, such as a heap-based overflow in the check idx function, might also exist but their exploitability is uncertain.

Recommendations For makeindex version 2.14 in teTeX, consider restricting the length of filenames to prevent potential buffer overflows until a patch is available. As a temporary workaround, avoid using long filenames with the open sty function to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-0650

Affected Products

Makeindex

References · 12

• http://security.gentoo.org/glsa/glsa-200711-34.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:109 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200805-13.xml · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200709-17.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0650 · Security Note
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=225491 · Note
• https://issues.rpath.com/browse/RPL-1036 · Note
• http://secunia.com/advisories/26982 · Note
• http://secunia.com/advisories/30168 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32284 · Note
• http://vupen.com/english/advisories/2007/1706 · Note
• http://securityfocus.com/bid/23872 · Note