Multiple buffer overflows in the (1) recognize_eps_file function (src/psgen.c) and (2) tilde_subst function (src/util.c) in GNU enscript 1.6.1, and possibly earlier, might allow remote attackers to execute arbitrary code via an epsf escape sequence with a long filename.

From Red Hat Security Advisory 2008:1021 :

An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts.

Several buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the 'special escapes' option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306, CVE-2008-5078)

All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues.

Several buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the 'special escapes' option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306, CVE-2008-5078)

Long path names could overflow a buffer in enscript. (CVE-2008-5078)

An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts.

Several buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the 'special escapes' option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306, CVE-2008-5078)

All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues.

ID	Name	Product	Family	Severity
67773	Oracle Linux 3 / 4 : enscript (ELSA-2008-1021)	Nessus	Oracle Linux Local Security Checks	high
60504	Scientific Linux Security Update : enscript on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
41277	SuSE9 Security Update : enscript (YOU Patch Number 12349)	Nessus	SuSE Local Security Checks	medium
35180	RHEL 2.1 / 3 / 4 : enscript (RHSA-2008:1021)	Nessus	Red Hat Local Security Checks	high
35172	CentOS 3 / 4 : enscript (CESA-2008:1021)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2008-5078

critical

Tenable Plugins

high

high

medium

high

high