Erik Sjolund discovered several vulnerabilities in enscript which could cause arbitrary code execution with the privileges of the user calling enscript.

Quotes and other shell escape characters in titles and file names were not handled in previous versions. (CAN-2004-1184)

Previous versions supported reading EPS data not only from a file, but also from an arbitrary command pipe. Since checking for unwanted side effects is infeasible, this feature has been disabled after consultation with the authors of enscript. (CAN-2004-1185)

Finally, this update fixes two buffer overflows which were triggered by certain input files. (CAN-2004-1186)

These issues can lead to privilege escalation if enscript is called automatically from web server applications like viewcvs.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability in the enscript program's handling of the epsf command used to insert inline EPS file into a document was found. An attacker could create a carefully crafted ASCII file which would make used of the epsf pipe command in such a way that it could execute arbitrary commands if the file was opened with enscript (CVE-2004-1184).

Additionally, flaws were found in enscript that could be abused by executing enscript with carefully crafted command-line arguments.
These flaws only have a security impact if enscript is executed by other programs and passed untrusted data from remote users (CVE-2004-1185 and CVE-2004-1186).

The updated packages have been patched to prevent these problems.

Erik Sjolund has discovered several security relevant problems in enscript, a program to converts ASCII text to Postscript and other formats. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CVE-2004-1184

    Unsanitised input can causes the execution of arbitrary     commands via EPSF pipe support. This has been disabled,     also upstream.

  - CVE-2004-1185

    Due to missing sanitising of filenames it is possible     that a specially crafted filename can cause arbitrary     commands to be executed.

  - CVE-2004-1186

    Multiple buffer overflows can cause the program to     crash.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated enscript package that fixes several security issues is now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GNU enscript converts ASCII files to PostScript.

Enscript has the ability to interpret special escape sequences. A flaw was found in the handling of the epsf command used to insert inline EPS files into a document. An attacker could create a carefully crafted ASCII file which made use of the epsf pipe command in such a way that it could execute arbitrary commands if the file was opened with enscript by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1184 to this issue.

Additional flaws in Enscript were also discovered which can only be triggered by executing enscript with carefully crafted command line arguments. These flaws therefore only have a security impact if enscript is executed by other programs and passed untrusted data from remote users. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-1185 and CVE-2004-1186 to these issues.

All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200502-03 (enscript: Multiple vulnerabilities)

    Erik Sjolund discovered several issues in enscript: it suffers     from several buffer overflows (CAN-2004-1186), quotes and shell escape     characters are insufficiently sanitized in filenames (CAN-2004-1185),     and it supported taking input from an arbitrary command pipe, with     unwanted side effects (CAN-2004-1184).
  Impact :

    An attacker could design malicious files or input data which, once     feeded into enscript, would trigger the execution of arbitrary code     with the rights of the user running enscript.
  Workaround :

    There is no known workaround at this time.

Erik Sjolund has discovered several security relevant problems in enscript, a program to convert ASCII text into Postscript and other formats. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CAN-2004-1184     Unsanitised input can cause the execution of arbitrary     commands via EPSF pipe support. This has been disabled,     also upstream.

  - CAN-2004-1185

    Due to missing sanitising of filenames it is possible     that a specially crafted filename can cause arbitrary     commands to be executed.

  - CAN-2004-1186

    Multiple buffer overflows can cause the program to     crash.

Usually, enscript is only run locally, but since it is executed inside of viewcvs some of the problems mentioned above can easily be turned into a remote vulnerability.

An updated enscript package that fixes several security issues is now available.

GNU enscript converts ASCII files to PostScript.

Enscript has the ability to interpret special escape sequences. A flaw was found in the handling of the epsf command used to insert inline EPS files into a document. An attacker could create a carefully crafted ASCII file which made use of the epsf pipe command in such a way that it could execute arbitrary commands if the file was opened with enscript by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1184 to this issue.

Additional flaws in Enscript were also discovered which can only be triggered by executing enscript with carefully crafted command line arguments. These flaws therefore only have a security impact if enscript is executed by other programs and passed untrusted data from remote users. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-1185 and CVE-2004-1186 to these issues.

All users of enscript should upgrade to these updated packages, which resolve these issues.

- Unsanitised input can caues the execution of arbitrary     commands via EPSF pipe support. This has been disabled,     also upstream. (CVE-2004-1184)

  - Due to missing sanitising of filenames it is possible     that a specially crafted filename can cause arbitrary     commands to be executed. (CVE-2004-1185)

  - Multiple buffer overflows can cause the program to     crash. (CVE-2004-1186)

Erik Sjolund discovered several issues in enscript : it suffers from several buffer overflows, quotes and shell escape characters are insufficiently sanitized in filenames, and it supported taking input from an arbitrary command pipe, with unwanted side effects.

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2009-002 applied.

This security update contains fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - IPSec
  - Kerberos
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - OpenSSL
  - QuickDraw Manager
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - X11

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

ID	Name	Product	Family	Published	Updated	Severity
20688	Ubuntu 4.10 : enscript vulnerabilities (USN-68-1)	Nessus	Ubuntu Local Security Checks	2006/01/15	2021/01/19	high
16376	Mandrake Linux Security Advisory : enscript (MDKSA-2005:033)	Nessus	Mandriva Local Security Checks	2005/02/11	2021/01/06	high
16268	Fedora Core 3 : enscript-1.6.1-28.0.2 (2005-016)	Nessus	Fedora Local Security Checks	2005/01/27	2021/01/11	high
16267	Fedora Core 2 : enscript-1.6.1-25.2 (2005-015)	Nessus	Fedora Local Security Checks	2005/01/27	2021/01/11	high
17172	RHEL 4 : enscript (RHSA-2005:040)	Nessus	Red Hat Local Security Checks	2005/02/22	2021/01/14	high
16440	GLSA-200502-03 : enscript: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2005/02/14	2021/01/06	high
16238	Debian DSA-654-1 : enscript - several vulnerabilities	Nessus	Debian Local Security Checks	2005/01/25	2021/01/04	high
16296	RHEL 2.1 / 3 : enscript (RHSA-2005:039)	Nessus	Red Hat Local Security Checks	2005/02/02	2021/01/14	high
41347	SuSE9 Security Update : enscript (YOU Patch Number 9867)	Nessus	SuSE Local Security Checks	2009/09/24	2021/01/14	high
18981	FreeBSD : enscript -- multiple vulnerabilities (72da8af6-7c75-11d9-8cc5-000854d03344)	Nessus	FreeBSD Local Security Checks	2005/07/13	2021/01/06	high
38743	Mac OS X Multiple Vulnerabilities (Security Update 2009-002)	Nessus	MacOS X Local Security Checks	2009/05/13	2018/07/14	critical
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection			high
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2009/05/13	2018/07/14	critical
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2004/08/18	2019/03/06	critical

Plugins Search