Vulnerability Name:

CVE-2003-0434 (CCN-12323)

Assigned:2003-06-14
Published:2003-06-14
Updated:2017-10-11
Summary:Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters in an embedded hyperlink.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2003-0434

Source: CCN
Type: Conectiva Linux Security Announcement CLSA-2003:674
xpdf

Source: FULLDISC
Type: UNKNOWN
20030613 -10Day CERT Advisory on PDF Files

Source: BUGTRAQ
Type: UNKNOWN
20030709 xpdf vulnerability - CAN-2003-0434

Source: CCN
Type: RHSA-2003-196
Updated Xpdf packages fix security vulnerability.

Source: CCN
Type: RHSA-2003-197
xpdf security update

Source: CCN
Type: RHSA-2003-216
Updated Xpdf packages fix security vulnerability

Source: CCN
Type: SA9037
Xpdf Embedded Link Arbitrary Command Execution Vulnerability

Source: SECUNIA
Type: UNKNOWN
9037

Source: CCN
Type: SA9038
Adobe Acrobat Reader Command Execution

Source: SECUNIA
Type: UNKNOWN
9038

Source: CCN
Type: Sun Alert ID: 55601
On Sun Linux, an Unauthorized Remote User May be Able to Execute Arbitrary Commands With the "xpdf" User's Privileges

Source: CCN
Type: Adobe Web site
Adobe Systems Incorporated

Source: CCN
Type: CIAC Information Bulletin N-107
UNIX PDF readers/viewers Malicious Hyperlinks Vulnerability

Source: CCN
Type: Xpdf Web site
What is Xpdf?

Source: CCN
Type: US-CERT VU#200132
Various UNIX and Linux PDF readers/viewers execute commands embedded within hyperlinks

Source: CERT-VN
Type: US Government Resource
VU#200132

Source: CCN
Type: Gentoo Linux Security Announcement 200306-11
xpdf

Source: CCN
Type: Gentoo Linux Security Announcement 200306-12
acroread

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2003:071

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2003:196

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2003:197

Source: CCN
Type: BID-7912
Multiple Vendor PDF Hyperlinks Arbitrary Command Execution Vulnerability

Source: CCN
Type: TLSA-2003-39
Vulnerability in Xpdf

Source: XF
Type: UNKNOWN
adobe-acrobat-command-execution(12323)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:664

Vulnerable Configuration:Configuration 1:
  • cpe:/a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:xpdf:xpdf:1.1:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:mandrakesoft:mandrake_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:advanced_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:enterprise_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:workstation:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.3:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1:*:itanium:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:foolabs:xpdf:0.5:a:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:5.0.6:*:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:linux:7:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.3:*:*:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:6.0:*:*:*:workstation:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:aw:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.1::ppc:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:664
    V
    		Code Execution Vulnerability in XPDF PDF Viewer
    2007-04-25
    BACK
    adobe acrobat 5.0.6
    xpdf xpdf 1.1
    mandrakesoft mandrake linux 9.0
    mandrakesoft mandrake linux 9.1
    mandrakesoft mandrake linux corporate server 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat linux 7.1
    redhat linux 7.2
    redhat linux 7.3
    redhat linux 8.0
    redhat linux 9.0
    redhat linux advanced workstation 2.1
    foolabs xpdf 0.5 a
    adobe acrobat reader 5.0.6
    redhat linux 7
    redhat linux 7.1
    conectiva linux 7.0
    redhat linux 7.2
    conectiva linux 8.0
    redhat linux 7.3
    gentoo linux *
    redhat linux 8.0
    mandrakesoft mandrake linux 9.0
    turbolinux turbolinux workstation 6.0
    mandrakesoft mandrake linux corporate server 2.1
    mandrakesoft mandrake linux 9.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat linux 9.0
    redhat enterprise linux 2.1
    conectiva linux 9.0
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux 9.1
    mandrakesoft mandrake linux corporate server 2.1