Quantum Secular Labs / Blog / Advisories

CVE-2004-0888: Easy Software Products Cups: Buffer overflow

CVE-2004-0888 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Easy Software Products Cups, along with 12 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and kdegraphics, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0889.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access vector: Network. Exploitable remotely over the network.
  • Access complexity: Low. No special conditions are required.
  • Authentication: None. No authentication is needed.
  • Confidentiality impact: Complete. Total information disclosure.
  • Integrity impact: Complete. Total loss of integrity.
  • Availability impact: Complete. Total shutdown of the component.

Affected products

  • Easy Software Products Cups: 1.0.4; 1.0.4_8; 1.1.1; 1.1.4; 1.1.4_2; 1.1.4_3; 1.1.4_5; 1.1.6; 1.1.7; 1.1.10; 1.1.12; 1.1.13
  • Gnome Gpdf: 0.112; 0.131
  • Xpdf: 0.90; 0.91; 0.92; 0.93; 1.0; 1.0a; 1.1; 2.0; 2.1; 2.3; 3.0
  • Kde: 3.2; 3.2.1; 3.2.2; 3.2.3; 3.3; 3.3.1
  • Kde Koffice: 1.3; 1.3.1; 1.3.2; 1.3.3; 1.3_beta1; 1.3_beta2; 1.3_beta3
  • Kde Kpdf: 3.2
  • Pdftohtml: 0.32a; 0.32b; 0.33; 0.33a; 0.34; 0.35; 0.36
  • Tetex: 1.0.7; 2.0; 2.0.1; 2.0.2
  • Debian Linux: 3.0
  • Gentoo Linux: all versions listed by NVD
  • Red Hat Enterprise Linux: 2.1; 3.0
  • Red Hat Enterprise Linux Desktop: 3.0
  • Red Hat Fedora Core: core_2.0
  • Red Hat Linux Advanced Workstation: 2.1
  • Suse Linux: 8.0; 8.1; 8.2; 9.0; 9.1; 9.2

References