Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence.

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2008-538:01 advisory.

    GNU enscript is a free replacement for Adobe's Enscript program. Enscript     converts ASCII files to PostScript(TM) and spools generated PostScript output     to the specified printer or saves it to a file. Enscript can be extended to     handle different output media and includes many options for customizing     printouts.
    Bugs fixed:
    CVE-2008-3863     Stack-based buffer overflow in the read_special_escape function in src/psgen.c     in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes     processing) option is enabled, allows user-assisted remote attackers to execute     arbitrary code via a crafted ASCII file, related to the setfilename command.
    CVE-2008-4306     Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors,     possibly related to the font escape sequence.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2008:1021 :

An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts.

Several buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the 'special escapes' option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306, CVE-2008-5078)

All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2008-1016 advisory.

    [1.6.4-4.1.1]
    - fixed CVE-2008-3863 and CVE-2008-4306

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the 'special escapes' option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306, CVE-2008-5078)

An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts.

Two buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the 'special escapes' option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306)

All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues.

Ulf Harnhammar discovered multiple stack overflows in enscript's handling of special escape arguments. If a user or automated system were tricked into processing a malicious file with the '-e' option enabled, a remote attacker could execute arbitrary code or cause enscript to crash, possibly leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two buffer overflow vulnerabilities were discovered in GNU enscript, which could allow an attacker to execute arbitrary commands via a specially crafted ASCII file, if the file were opened with the -e or
--escapes option enabled (CVE-2008-3863, CVE-2008-4306).

The updated packages have been patched to prevent these issues.

An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts.

Several buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the 'special escapes' option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306, CVE-2008-5078)

All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200812-02 (enscript: User-assisted execution of arbitrary code)

    Two stack-based buffer overflows in the read_special_escape() function     in src/psgen.c have been reported. Ulf Harnhammar of Secunia Research     discovered a vulnerability related to the 'setfilename' command     (CVE-2008-3863), and Kees Cook of Ubuntu discovered a vulnerability     related to the 'font' escape sequence (CVE-2008-4306).
  Impact :

    An attacker could entice a user or automated system to process     specially crafted input with the special escapes processing enabled     using the '-e' option, possibly resulting in the execution of arbitrary     code.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in Enscript, a converter from ASCII text to Postscript, HTML or RTF. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-3863     Ulf Harnhammer discovered that a buffer overflow may     lead to the execution of arbitrary code.

  - CVE-2008-4306     Kees Cook and Tomas Hoger discovered that several buffer     overflows may lead to the execution of arbitrary code.

Ulf Harnhammar of Secunia Research reports :

Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.

There were found various buffer overflows in enscript. This update fixes CVE-2008-3863 and CVE-2008-4306

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
284112	MiracleLinux 3 : enscript-1.6.4-4.1.1.1AXS3 (AXSA:2008-538:01)	Nessus	Miracle Linux Local Security Checks	Local	high
67773	Oracle Linux 3 / 4 : enscript (ELSA-2008-1021)	Nessus	Oracle Linux Local Security Checks	Local	high
67771	Oracle Linux 5 : enscript (ELSA-2008-1016)	Nessus	Oracle Linux Local Security Checks	Local	high
60504	Scientific Linux Security Update : enscript on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	Local	high
43718	CentOS 5 : enscript (CESA-2008:1016)	Nessus	CentOS Local Security Checks	Local	high
38023	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : enscript vulnerability (USN-660-1)	Nessus	Ubuntu Local Security Checks	Local	high
36321	Mandriva Linux Security Advisory : enscript (MDVSA-2008:243)	Nessus	Mandriva Local Security Checks	Local	high
35180	RHEL 2.1 / 3 / 4 : enscript (RHSA-2008:1021)	Nessus	Red Hat Local Security Checks	Local	high
35178	RHEL 5 : enscript (RHSA-2008:1016)	Nessus	Red Hat Local Security Checks	Local	high
35172	CentOS 3 / 4 : enscript (CESA-2008:1021)	Nessus	CentOS Local Security Checks	Local	high
35019	GLSA-200812-02 : enscript: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	Local	high
34949	Debian DSA-1670-1 : enscript - buffer overflows	Nessus	Debian Local Security Checks	Local	high
34817	FreeBSD : enscript -- arbitrary code execution vulnerability (a1126054-b57c-11dd-8892-0017319806e7)	Nessus	FreeBSD Local Security Checks	Local	high
34705	Fedora 9 : enscript-1.6.4-10.fc9 (2008-9372)	Nessus	Fedora Local Security Checks	Local	high
34702	Fedora 8 : enscript-1.6.4-9.fc8 (2008-9351)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2008-4306

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high