Enscript 1.6.3 does not sanitize filenames, which allows remote attackers or local users to execute arbitrary commands via crafted filenames.

- Unsanitised input can caues the execution of arbitrary     commands via EPSF pipe support. This has been disabled,     also upstream. (CVE-2004-1184)

  - Due to missing sanitising of filenames it is possible     that a specially crafted filename can cause arbitrary     commands to be executed. (CVE-2004-1185)

  - Multiple buffer overflows can cause the program to     crash. (CVE-2004-1186)

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2009-002 applied.

This security update contains fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - IPSec
  - Kerberos
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - OpenSSL
  - QuickDraw Manager
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - X11

Erik Sjolund discovered several vulnerabilities in enscript which could cause arbitrary code execution with the privileges of the user calling enscript.

Quotes and other shell escape characters in titles and file names were not handled in previous versions. (CAN-2004-1184)

Previous versions supported reading EPS data not only from a file, but also from an arbitrary command pipe. Since checking for unwanted side effects is infeasible, this feature has been disabled after consultation with the authors of enscript. (CAN-2004-1185)

Finally, this update fixes two buffer overflows which were triggered by certain input files. (CAN-2004-1186)

These issues can lead to privilege escalation if enscript is called automatically from web server applications like viewcvs.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Erik Sjolund discovered several issues in enscript : it suffers from several buffer overflows, quotes and shell escape characters are insufficiently sanitized in filenames, and it supported taking input from an arbitrary command pipe, with unwanted side effects.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:040 advisory.

    GNU enscript converts ASCII files to PostScript.

    Enscript has the ability to interpret special escape sequences.  A flaw was     found in the handling of the epsf command used to insert inline EPS files     into a document.  An attacker could create a carefully crafted ASCII file     which made use of the epsf pipe command in such a way that it could execute     arbitrary commands if the file was opened with enscript by a victim.  The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2004-1184 to this issue.

    Additional flaws in Enscript were also discovered which can only be     triggered by executing enscript with carefully crafted command line     arguments.  These flaws therefore only have a security impact if enscript     is executed by other programs and passed untrusted data from remote users.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the names CAN-2004-1185 and CAN-2004-1186 to these issues.

    All users of enscript should upgrade to these updated packages, which     contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200502-03 (enscript: Multiple vulnerabilities)

    Erik Sjolund discovered several issues in enscript: it suffers     from several buffer overflows (CAN-2004-1186), quotes and shell escape     characters are insufficiently sanitized in filenames (CAN-2004-1185),     and it supported taking input from an arbitrary command pipe, with     unwanted side effects (CAN-2004-1184).
  Impact :

    An attacker could design malicious files or input data which, once     feeded into enscript, would trigger the execution of arbitrary code     with the rights of the user running enscript.
  Workaround :

    There is no known workaround at this time.

A vulnerability in the enscript program's handling of the epsf command used to insert inline EPS file into a document was found. An attacker could create a carefully crafted ASCII file which would make used of the epsf pipe command in such a way that it could execute arbitrary commands if the file was opened with enscript (CVE-2004-1184).

Additionally, flaws were found in enscript that could be abused by executing enscript with carefully crafted command-line arguments.
These flaws only have a security impact if enscript is executed by other programs and passed untrusted data from remote users (CVE-2004-1185 and CVE-2004-1186).

The updated packages have been patched to prevent these problems.

An updated enscript package that fixes several security issues is now available.

GNU enscript converts ASCII files to PostScript.

Enscript has the ability to interpret special escape sequences. A flaw was found in the handling of the epsf command used to insert inline EPS files into a document. An attacker could create a carefully crafted ASCII file which made use of the epsf pipe command in such a way that it could execute arbitrary commands if the file was opened with enscript by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1184 to this issue.

Additional flaws in Enscript were also discovered which can only be triggered by executing enscript with carefully crafted command line arguments. These flaws therefore only have a security impact if enscript is executed by other programs and passed untrusted data from remote users. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-1185 and CVE-2004-1186 to these issues.

All users of enscript should upgrade to these updated packages, which resolve these issues.

Erik Sjolund has discovered several security relevant problems in enscript, a program to converts ASCII text to Postscript and other formats. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CVE-2004-1184

    Unsanitised input can causes the execution of arbitrary     commands via EPSF pipe support. This has been disabled,     also upstream.

  - CVE-2004-1185

    Due to missing sanitising of filenames it is possible     that a specially crafted filename can cause arbitrary     commands to be executed.

  - CVE-2004-1186

    Multiple buffer overflows can cause the program to     crash.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Erik Sjolund has discovered several security relevant problems in enscript, a program to convert ASCII text into Postscript and other formats. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CAN-2004-1184     Unsanitised input can cause the execution of arbitrary     commands via EPSF pipe support. This has been disabled,     also upstream.

  - CAN-2004-1185

    Due to missing sanitising of filenames it is possible     that a specially crafted filename can cause arbitrary     commands to be executed.

  - CAN-2004-1186

    Multiple buffer overflows can cause the program to     crash.

Usually, enscript is only run locally, but since it is executed inside of viewcvs some of the problems mentioned above can easily be turned into a remote vulnerability.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

ID	Name	Product	Family	Severity
41347	SuSE9 Security Update : enscript (YOU Patch Number 9867)	Nessus	SuSE Local Security Checks	high
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
38743	Mac OS X Multiple Vulnerabilities (Security Update 2009-002)	Nessus	MacOS X Local Security Checks	critical
20688	Ubuntu 4.10 : enscript vulnerabilities (USN-68-1)	Nessus	Ubuntu Local Security Checks	high
18981	FreeBSD : enscript -- multiple vulnerabilities (72da8af6-7c75-11d9-8cc5-000854d03344)	Nessus	FreeBSD Local Security Checks	high
17172	RHEL 4 : enscript (RHSA-2005:040)	Nessus	Red Hat Local Security Checks	medium
16440	GLSA-200502-03 : enscript: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
16376	Mandrake Linux Security Advisory : enscript (MDKSA-2005:033)	Nessus	Mandriva Local Security Checks	high
16296	RHEL 2.1 / 3 : enscript (RHSA-2005:039)	Nessus	Red Hat Local Security Checks	high
16268	Fedora Core 3 : enscript-1.6.1-28.0.2 (2005-016)	Nessus	Fedora Local Security Checks	high
16267	Fedora Core 2 : enscript-1.6.1-25.2 (2005-015)	Nessus	Fedora Local Security Checks	high
16238	Debian DSA-654-1 : enscript - several vulnerabilities	Nessus	Debian Local Security Checks	high
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2004-1185

critical

Tenable Plugins

high

critical

critical

high

high

medium

high

high

high

high

high

high

critical

high