a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.

Rudolf Polzer reports :

a2ps builds a command line for file() containing an unescaped version of the file name, thus might call external programs described by the file name. Running a cronjob over a public writable directory a2ps-ing all files in it - or simply typing 'a2ps *.txt' in /tmp - is therefore dangerous.

The remote host is affected by the vulnerability described in GLSA-200501-02 (a2ps: Multiple vulnerabilities)

    Javier Fernandez-Sanguino Pena discovered that the a2ps package     contains two scripts that create insecure temporary files (fixps and     psmandup). Furthermore, we fixed in a previous revision a vulnerability     in a2ps filename handling (CAN-2004-1170).
  Impact :

    A local attacker could create symbolic links in the temporary files     directory, pointing to a valid file somewhere on the filesystem. When     fixps or psmandup is executed, this would result in the file being     overwritten with the rights of the user running the utility. By     enticing a user or script to run a2ps on a malicious filename, an     attacker could execute arbitrary commands on the system with the rights     of that user or script.
  Workaround :

    There is no known workaround at this time.

Rudolf Polzer discovered a vulnerability in a2ps, a converter and pretty-printer for many formats to PostScript. The program did not escape shell meta characters properly which could lead to the execution of arbitrary commands as a privileged user if a2ps is installed as a printer filter.

The GNU a2ps utility fails to properly sanitize filenames, which can be abused by a malicious user to execute arbitrary commands with the privileges of the user running the vulnerable application.

The updated packages have been patched to prevent this problem.

ID	Name	Product	Family	Severity
37951	FreeBSD : a2ps -- insecure command line argument handling (8091fcea-f35e-11d8-81b0-000347a4fa7d)	Nessus	FreeBSD Local Security Checks	critical
16393	GLSA-200501-02 : a2ps: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
16008	Debian DSA-612-1 : a2ps - unsanitised input	Nessus	Debian Local Security Checks	critical
15838	Mandrake Linux Security Advisory : a2ps (MDKSA-2004:140)	Nessus	Mandriva Local Security Checks	critical

Detections

Analytics

CVE-2004-1170

critical

Tenable Plugins

critical

critical

critical

critical