Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.

From Red Hat Security Advisory 2008:1021 :

An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts.

Several buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the 'special escapes' option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306, CVE-2008-5078)

All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues.

From Red Hat Security Advisory 2008:1016 :

An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts.

Two buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the 'special escapes' option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306)

All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues.

Several buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the 'special escapes' option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306, CVE-2008-5078)

An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts.

Two buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the 'special escapes' option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306)

All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues.

This update of enscript fixes buffer overflows in the setfilename (CVE-2008-3863), process_file and read_special_escape function that can be exploited during file processing.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2009-002 applied.

This security update contains fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - IPSec
  - Kerberos
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - OpenSSL
  - QuickDraw Manager
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - X11

Ulf Harnhammar discovered multiple stack overflows in enscript's handling of special escape arguments. If a user or automated system were tricked into processing a malicious file with the '-e' option enabled, a remote attacker could execute arbitrary code or cause enscript to crash, possibly leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two buffer overflow vulnerabilities were discovered in GNU enscript, which could allow an attacker to execute arbitrary commands via a specially crafted ASCII file, if the file were opened with the -e or
--escapes option enabled (CVE-2008-3863, CVE-2008-4306).

The updated packages have been patched to prevent these issues.

An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts.

Several buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the 'special escapes' option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306, CVE-2008-5078)

All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200812-02 (enscript: User-assisted execution of arbitrary code)

    Two stack-based buffer overflows in the read_special_escape() function     in src/psgen.c have been reported. Ulf Harnhammar of Secunia Research     discovered a vulnerability related to the 'setfilename' command     (CVE-2008-3863), and Kees Cook of Ubuntu discovered a vulnerability     related to the 'font' escape sequence (CVE-2008-4306).
  Impact :

    An attacker could entice a user or automated system to process     specially crafted input with the special escapes processing enabled     using the '-e' option, possibly resulting in the execution of arbitrary     code.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in Enscript, a converter from ASCII text to Postscript, HTML or RTF. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-3863     Ulf Harnhammer discovered that a buffer overflow may     lead to the execution of arbitrary code.

  - CVE-2008-4306     Kees Cook and Tomas Hoger discovered that several buffer     overflows may lead to the execution of arbitrary code.

Ulf Harnhammar of Secunia Research reports :

Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.

There were found various buffer overflows in enscript. This update fixes CVE-2008-3863 and CVE-2008-4306

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

ID	Name	Product	Family	Severity
67773	Oracle Linux 3 / 4 : enscript (ELSA-2008-1021)	Nessus	Oracle Linux Local Security Checks	high
67771	Oracle Linux 5 : enscript (ELSA-2008-1016)	Nessus	Oracle Linux Local Security Checks	high
60504	Scientific Linux Security Update : enscript on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43718	CentOS 5 : enscript (CESA-2008:1016)	Nessus	CentOS Local Security Checks	high
41251	SuSE9 Security Update : enscript (YOU Patch Number 12275)	Nessus	SuSE Local Security Checks	high
39955	openSUSE Security Update : enscript (enscript-274)	Nessus	SuSE Local Security Checks	high
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
38743	Mac OS X Multiple Vulnerabilities (Security Update 2009-002)	Nessus	MacOS X Local Security Checks	critical
38023	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : enscript vulnerability (USN-660-1)	Nessus	Ubuntu Local Security Checks	high
36321	Mandriva Linux Security Advisory : enscript (MDVSA-2008:243)	Nessus	Mandriva Local Security Checks	high
35180	RHEL 2.1 / 3 / 4 : enscript (RHSA-2008:1021)	Nessus	Red Hat Local Security Checks	high
35178	RHEL 5 : enscript (RHSA-2008:1016)	Nessus	Red Hat Local Security Checks	high
35172	CentOS 3 / 4 : enscript (CESA-2008:1021)	Nessus	CentOS Local Security Checks	high
35019	GLSA-200812-02 : enscript: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
34949	Debian DSA-1670-1 : enscript - buffer overflows	Nessus	Debian Local Security Checks	high
34817	FreeBSD : enscript -- arbitrary code execution vulnerability (a1126054-b57c-11dd-8892-0017319806e7)	Nessus	FreeBSD Local Security Checks	high
34709	openSUSE 10 Security Update : enscript (enscript-5719)	Nessus	SuSE Local Security Checks	high
34708	SuSE 10 Security Update : enscript (ZYPP Patch Number 5715)	Nessus	SuSE Local Security Checks	high
34705	Fedora 9 : enscript-1.6.4-10.fc9 (2008-9372)	Nessus	Fedora Local Security Checks	high
34702	Fedora 8 : enscript-1.6.4-9.fc8 (2008-9351)	Nessus	Fedora Local Security Checks	high
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2008-3863

critical

Tenable Plugins

high

high

high

high

high

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

critical

high