CVE-2003-0434

Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters in an embedded hyperlink.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.grok.org.uk/pipermail/full-disclosure/2003-June/005719.html
http://marc.info/?l=bugtraq&m=105777963019186&w=2
http://secunia.com/advisories/9037
http://secunia.com/advisories/9038
http://www.kb.cert.org/vuls/id/200132	US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2003:071
http://www.redhat.com/support/errata/RHSA-2003-196.html	Patch Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2003-197.html	Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A664

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:acrobat:5.0.6:::::::*
	cpe:2.3:a:xpdf:xpdf:1.1:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:mandrakesoft:mandrake_linux:9.0:::::::*
	cpe:2.3:o:mandrakesoft:mandrake_linux:9.1:::::::*
	cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:2.1:::::::*
	cpe:2.3:o:redhat:enterprise_linux:2.1::advanced_server:::::
	cpe:2.3:o:redhat:enterprise_linux:2.1::enterprise_server:::::
	cpe:2.3:o:redhat:enterprise_linux:2.1::workstation:::::
	cpe:2.3:o:redhat:linux:7.1:::::::*
	cpe:2.3:o:redhat:linux:7.2:::::::*
	cpe:2.3:o:redhat:linux:7.3:::::::*
	cpe:2.3:o:redhat:linux:8.0:::::::*
	cpe:2.3:o:redhat:linux:9.0:::::::*
	cpe:2.3:o:redhat:linux_advanced_workstation:2.1::itanium:::::

History

No history.

Information

Published : 2003-07-24 04:00

Updated : 2017-10-11 01:29

NVD link : CVE-2003-0434

Mitre link : CVE-2003-0434

CVE.ORG link : CVE-2003-0434

JSON object : View

Products Affected

xpdf

xpdf

mandrakesoft

mandrake_linux_corporate_server
mandrake_linux

redhat

enterprise_linux
linux_advanced_workstation
linux

adobe

acrobat

CWE

NVD-CWE-Other

{"id": "CVE-2003-0434", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2003-07-24T04:00:00.000", "references": [{"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-June/005719.html", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=105777963019186&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/9037", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/9038", "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/200132", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:071", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2003-196.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2003-197.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A664", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters in an embedded hyperlink."}, {"lang": "es", "value": "Varios visores de PDF, incluidos Adobe Acrobat 5.06 y Xpdf 1.01 permiten a atacantes remotos la ejecuci\u00f3n arbitraria de comandos mediante metacaracteres de shell en un hiperv\u00ednculo embebido."}], "lastModified": "2017-10-11T01:29:10.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B453FA1D-0FE9-4324-9644-E167561926C2"}, {"criteria": "cpe:2.3:a:xpdf:xpdf:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B9DEF16-ECD5-4BBE-8986-52A6171B3D9F"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:mandrakesoft:mandrake_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33F6F859-B7B8-4072-B073-6CC8291D642E"}, {"criteria": "cpe:2.3:o:mandrakesoft:mandrake_linux:9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4AD30B9-8FBA-48B3-B2B2-014C950B9BAA"}, {"criteria": "cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0F0D201-B1DC-4024-AF77-A284673618F3"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:2.1:*:advanced_server:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2641EE56-6F9D-400B-B456-877F4DA79B10"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:2.1:*:enterprise_server:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0B458EA-495E-40FA-9379-C03757F7B1EE"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:2.1:*:workstation:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1728AB5D-55A9-46B0-A412-6F7263CAEB5A"}, {"criteria": "cpe:2.3:o:redhat:linux:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D46E093-1C68-43BB-B281-12117EC8DE0F"}, {"criteria": "cpe:2.3:o:redhat:linux:7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E562907F-D915-4030-847A-3C6834A80D4E"}, {"criteria": "cpe:2.3:o:redhat:linux:7.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "138985E6-5107-4E8B-A801-C3D5FE075227"}, {"criteria": "cpe:2.3:o:redhat:linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "038FEDE7-986F-4CA5-9003-BA68352B87D4"}, {"criteria": "cpe:2.3:o:redhat:linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E66F7BF0-EF7C-4695-9D67-7C1A01C6F9B9"}, {"criteria": "cpe:2.3:o:redhat:linux_advanced_workstation:2.1:*:itanium:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DBD9D3C-40AB-449D-A9A8-A09DF2DEDB96"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}