CVE-2002-0836 Command injection in n/a
Remote attackers can execute arbitrary commands via malicious PostScript print jobs due to insecure system calls in the dvips converter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2002-0836?
CVE-2002-0836 is a high-severity command injection vulnerability in Mandrakesoft Mandrake Linux, published on 1 Sep 2004. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts.
Which versions are affected by CVE-2002-0836?
It affects 3 products.
Products include Hp Secure Os, Mandrakesoft Mandrake Linux, Redhat Linux.
How do I fix CVE-2002-0836?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2002-0836 being exploited?
There is no known exploitation of CVE-2002-0836 in the wild and no public exploit code.
Other vulnerabilities in Mandrakesoft Mandrake Linux
Sources
Also known as DSA-207, GHSA-62pv-x8q7-86rc.