The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - a2ps: output_file() format string flaw (CVE-2015-8107)

  - The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-     dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.
    (CVE-2014-0466)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - a2ps: output_file() format string flaw (CVE-2015-8107)

  - The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-     dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.
    (CVE-2014-0466)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201701-67 (a2ps: Arbitrary code execution)

    a2ps&rsquo; fixps script does not invoke gs with the -dSAFER option.
  Impact :

    Remote attackers, by enticing a user to process a specially crafted       PostScript file, could delete arbitrary files or execute arbitrary code       with the privileges of the process.
  Workaround :

    There is no known workaround at this time.

a2ps was updated to fix a security issue :

fixps called ghostscript without -dSAFER, enabling postscript files processed by fixps to execute code on the system. (CVE-2014-0466)

This update fixes a security problem in the fixps utility (CVE-2014-0466).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The text to postscript converter a2ps received a security update.

The fixps script did not call ghostscript with the -DSAFER option, allowing command execution by attacker supplied postscript files.

Updated a2ps packages fix security vulnerability :

Brian M. Carlson reported that a2ps's fixps script does not invoke gs with the -dSAFER option. Consequently executing fixps on a malicious PostScript file could result in files being deleted or arbitrary commands being executed with the privileges of the user running fixps (CVE-2014-0466).

Several vulnerabilities have been found in a2ps, an 'Anything to PostScript' converter and pretty-printer. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2001-1593     The spy_user function which is called when a2ps is     invoked with the --debug flag insecurely used temporary     files.

  - CVE-2014-0466     Brian M. Carlson reported that a2ps's fixps script does     not invoke gs with the -dSAFER option. Consequently     executing fixps on a malicious PostScript file could     result in files being deleted or arbitrary commands     being executed with the privileges of the user running     fixps.

ID	Name	Product	Family	Severity
198679	RHEL 5 : a2ps (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198592	RHEL 6 : a2ps (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
96853	GLSA-201701-67 : a2ps: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
75316	openSUSE Security Update : a2ps (openSUSE-SU-2014:0499-1)	Nessus	SuSE Local Security Checks	medium
73926	Fedora 20 : a2ps-4.14-23.fc20 (2014-4691)	Nessus	Fedora Local Security Checks	medium
73925	Fedora 19 : a2ps-4.14-23.fc19 (2014-4676)	Nessus	Fedora Local Security Checks	medium
73783	SuSE 11.3 Security Update : a2ps (SAT Patch Number 9064)	Nessus	SuSE Local Security Checks	medium
73467	Mandriva Linux Security Advisory : a2ps (MDVSA-2014:076)	Nessus	Mandriva Local Security Checks	medium
73278	Debian DSA-2892-1 : a2ps - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-0466

critical

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium