The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-     dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.
    (CVE-2014-0466)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function
    and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a
    temporary file. (CVE-2001-1593)

  - The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-
    dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.
    (CVE-2014-0466)

The remote host is affected by the vulnerability described in GLSA-201701-67 (a2ps: Arbitrary code execution)

    a2ps&rsquo; fixps script does not invoke gs with the -dSAFER option.
  Impact :

    Remote attackers, by enticing a user to process a specially crafted       PostScript file, could delete arbitrary files or execute arbitrary code       with the privileges of the process.
  Workaround :

    There is no known workaround at this time.

a2ps was updated to fix a security issue :

fixps called ghostscript without -dSAFER, enabling postscript files processed by fixps to execute code on the system. (CVE-2014-0466)

This update fixes a security problem in the fixps utility (CVE-2014-0466).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The text to postscript converter a2ps received a security update.

The fixps script did not call ghostscript with the -DSAFER option, allowing command execution by attacker supplied postscript files.

Updated a2ps packages fix security vulnerability :

Brian M. Carlson reported that a2ps's fixps script does not invoke gs with the -dSAFER option. Consequently executing fixps on a malicious PostScript file could result in files being deleted or arbitrary commands being executed with the privileges of the user running fixps (CVE-2014-0466).

Several vulnerabilities have been found in a2ps, an 'Anything to PostScript' converter and pretty-printer. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2001-1593     The spy_user function which is called when a2ps is     invoked with the --debug flag insecurely used temporary     files.

  - CVE-2014-0466     Brian M. Carlson reported that a2ps's fixps script does     not invoke gs with the -dSAFER option. Consequently     executing fixps on a malicious PostScript file could     result in files being deleted or arbitrary commands     being executed with the privileges of the user running     fixps.

ID	Name	Product	Family	Severity
218181	Linux Distros Unpatched Vulnerability : CVE-2014-0466	Nessus	Misc.	critical
401086	Alpine: multiple a2ps packages: security update to 4.14-r4 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
401086	Alpine: multiple a2ps packages: security update to 4.14-r4 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
96853	GLSA-201701-67 : a2ps: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
75316	openSUSE Security Update : a2ps (openSUSE-SU-2014:0499-1)	Nessus	SuSE Local Security Checks	medium
73926	Fedora 20 : a2ps-4.14-23.fc20 (2014-4691)	Nessus	Fedora Local Security Checks	medium
73925	Fedora 19 : a2ps-4.14-23.fc19 (2014-4676)	Nessus	Fedora Local Security Checks	medium
73783	SuSE 11.3 Security Update : a2ps (SAT Patch Number 9064)	Nessus	SuSE Local Security Checks	medium
73467	Mandriva Linux Security Advisory : a2ps (MDVSA-2014:076)	Nessus	Mandriva Local Security Checks	medium
73278	Debian DSA-2892-1 : a2ps - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-0466

critical

Tenable Plugins

critical

critical

critical

medium

medium

medium

medium

medium

medium

medium