#2009-010 mimeTeX and mathTeX buffer overflows and command injection Description: The mimeTeX and mathTeX CGIs are widely used helper executables that allow mathematical equation rendering in the form of images. Both applications suffer from several buffer overflows as well as command injection which result in remote code execution. The mimeTeX application suffers from several stack-based buffer overflows which can be remotely triggered by passing oversized TeX expressions. Additionally the \environ, \input and \counter directives may not be suitable for exposure to commands from the Internet. Similarly the mathTeX application does not perform sufficient input sanitization and allows untrusted input, passed via HTTP query strings, to be used as command arguments allowing command injection. Additionally it suffers from several stack-based overflows as well as insecure temporary file handling. Affected version: Unfortunately mimeTeX and mathTex are provided without version numbers by the maintainer, who releases version-less zip archives. It is therefore impossible to provide affected version numbers. Fixed version: At the release time for this advisory both versions available on the maintainer website fix the overflow and injection issues. mimeTeX, mimetex.zip (2009/07/13) mathTeX, mathtex.zip (2009/07/13) Credit: vulnerability report received from Chris Evans <cevans [at] google [dot] com> (mimetex) and Damien Miller <djm [at] google [dot] com> (mathtex), Google Security Team. CVE: CVE-2009-1382 (mimetex), CVE-2009-1383 (mathtex) Timeline: 2009-05-22: vulnerability report received 2009-05-25: contacted mimetex/mathtex maintainer 2009-05-25: maintainer publicly discloses report contents 2009-05-26: contacted affected vendors 2009-05-26: maintainer provides updated packages 2009-05-26: assigned CVEs 2009-05-26: reporters indicate that the updated packages do not fix all the issues 2009-05-29: reporters find additional overflows in updated packages 2009-06-01: maintainer contacted with updated report 2009-07-09: reporters confirm that updated packages fixing the reported issues are available 2009-07-13: advisory release References: http://scary.beasts.org/security/CESA-2009-009.html http://groups.google.com/group/comp.text.tex/browse_thread/thread/5d56d3 d744351578 Permalink: http://www.ocert.org/advisories/ocert-2009-010.html -- Andrea Barisani | Founder & Project Coordinator oCERT | Open Source Computer Emergency Response Team <lcars (at) ocert (dot) org [email concealed]> http://www.ocert.org 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E "Pluralitas non est ponenda sine necessitate"