Executive Summary
| Summary | |
|---|---|
| Title | enscript security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2008:1016 | First vendor Publication | 2008-12-15 |
| Vendor | RedHat | Last vendor Modification | 2008-12-15 |
| Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts. Two buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the "special escapes" option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306) All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/enscript-1.6.4-4.1.1.el5_2.src.rpm i386: enscript-1.6.4-4.1.1.el5_2.i386.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.i386.rpm x86_64: enscript-1.6.4-4.1.1.el5_2.x86_64.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/enscript-1.6.4-4.1.1.el5_2.src.rpm i386: enscript-1.6.4-4.1.1.el5_2.i386.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.i386.rpm ia64: enscript-1.6.4-4.1.1.el5_2.ia64.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.ia64.rpm ppc: enscript-1.6.4-4.1.1.el5_2.ppc.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.ppc.rpm s390x: enscript-1.6.4-4.1.1.el5_2.s390x.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.s390x.rpm x86_64: enscript-1.6.4-4.1.1.el5_2.x86_64.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2008-1016.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10718 | |||
| Oval ID: | oval:org.mitre.oval:def:10718 | ||
| Title: | Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence. | ||
| Description: | Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-4306 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:16828 | |||
| Oval ID: | oval:org.mitre.oval:def:16828 | ||
| Title: | USN-660-1 -- enscript vulnerability | ||
| Description: | Ulf HE4rnhammar discovered multiple stack overflows in enscript's handling of special escape arguments. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-660-1 CVE-2008-3863 CVE-2008-4306 | Version: | 7 |
| Platform(s): | Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 | Product(s): | enscript |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18482 | |||
| Oval ID: | oval:org.mitre.oval:def:18482 | ||
| Title: | DSA-1670-1 enscript - arbitrary code execution | ||
| Description: | Several vulnerabilities have been discovered in Enscript, a converter from ASCII text to Postscript, HTML or RTF. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1670-1 CVE-2008-3863 CVE-2008-4306 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | enscript |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:21904 | |||
| Oval ID: | oval:org.mitre.oval:def:21904 | ||
| Title: | ELSA-2008:1016: enscript security update (Moderate) | ||
| Description: | Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2008:1016-01 CVE-2008-3863 CVE-2008-4306 | Version: | 13 |
| Platform(s): | Oracle Linux 5 | Product(s): | enscript |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:28976 | |||
| Oval ID: | oval:org.mitre.oval:def:28976 | ||
| Title: | RHSA-2008:1016 -- enscript security update (Moderate) | ||
| Description: | An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts. Two buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the special escapes option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306) | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2008:1016 CESA-2008:1016-CentOS 5 CVE-2008-3863 CVE-2008-4306 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | enscript |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:7926 | |||
| Oval ID: | oval:org.mitre.oval:def:7926 | ||
| Title: | DSA-1670 enscript -- buffer overflows | ||
| Description: | Several vulnerabilities have been discovered in Enscript, a converter from ASCII text to Postscript, HTML or RTF. The Common Vulnerabilities and Exposures project identifies the following problems: Ulf Harnhammer discovered that a buffer overflow may lead to the execution of arbitrary code. Kees Cook and Tomas Hoger discovered that several buffer overflows may lead to the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1670 CVE-2008-3863 CVE-2008-4306 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | enscript |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:9939 | |||
| Oval ID: | oval:org.mitre.oval:def:9939 | ||
| Title: | Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command. | ||
| Description: | Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-3863 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 2 | |
| Os | 4 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-05-12 | Name : Mac OS X 10.5.7 Update / Mac OS X Security Update 2009-002 File : nvt/macosx_upd_10_5_7_secupd_2009-002.nasl |
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-10-13 | Name : SLES10: Security update for enscript File : nvt/sles10_enscript.nasl |
| 2009-10-10 | Name : SLES9: Security update for enscript File : nvt/sles9p5037640.nasl |
| 2009-04-09 | Name : Mandriva Update for enscript MDVSA-2008:243 (enscript) File : nvt/gb_mandriva_MDVSA_2008_243.nasl |
| 2009-03-23 | Name : Ubuntu Update for enscript vulnerability USN-660-1 File : nvt/gb_ubuntu_USN_660_1.nasl |
| 2009-03-06 | Name : RedHat Update for enscript RHSA-2008:1016-01 File : nvt/gb_RHSA-2008_1016-01_enscript.nasl |
| 2009-03-06 | Name : RedHat Update for enscript RHSA-2008:1021-02 File : nvt/gb_RHSA-2008_1021-02_enscript.nasl |
| 2009-02-27 | Name : CentOS Update for enscript CESA-2008:1021-02 centos2 i386 File : nvt/gb_CESA-2008_1021-02_enscript_centos2_i386.nasl |
| 2009-02-27 | Name : CentOS Update for enscript CESA-2008:1021 centos3 i386 File : nvt/gb_CESA-2008_1021_enscript_centos3_i386.nasl |
| 2009-02-27 | Name : CentOS Update for enscript CESA-2008:1021 centos3 x86_64 File : nvt/gb_CESA-2008_1021_enscript_centos3_x86_64.nasl |
| 2009-02-27 | Name : CentOS Update for enscript CESA-2008:1021 centos4 i386 File : nvt/gb_CESA-2008_1021_enscript_centos4_i386.nasl |
| 2009-02-27 | Name : CentOS Update for enscript CESA-2008:1021 centos4 x86_64 File : nvt/gb_CESA-2008_1021_enscript_centos4_x86_64.nasl |
| 2009-02-17 | Name : Fedora Update for enscript FEDORA-2008-9351 File : nvt/gb_fedora_2008_9351_enscript_fc8.nasl |
| 2009-02-17 | Name : Fedora Update for enscript FEDORA-2008-9372 File : nvt/gb_fedora_2008_9372_enscript_fc9.nasl |
| 2008-12-03 | Name : Gentoo Security Advisory GLSA 200812-02 (enscript) File : nvt/glsa_200812_02.nasl |
| 2008-12-03 | Name : Debian Security Advisory DSA 1670-1 (enscript) File : nvt/deb_1670_1.nasl |
| 2008-11-24 | Name : FreeBSD Ports: enscript-a4, enscript-letter, enscript-letterdj File : nvt/freebsd_enscript-a40.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 49569 | Enscript on Ubuntu Unspecified Issue |
| 49224 | GNU Enscript src/psgen.c read_special_escape() Function Special Escape Overflow |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2008-1021.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2008-1016.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20081215_enscript_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2008-1016.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12275.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_enscript-081030.nasl - Type : ACT_GATHER_INFO |
| 2009-05-13 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_5_7.nasl - Type : ACT_GATHER_INFO |
| 2009-05-13 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2009-002.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-660-1.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2008-243.nasl - Type : ACT_GATHER_INFO |
| 2008-12-16 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2008-1016.nasl - Type : ACT_GATHER_INFO |
| 2008-12-16 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2008-1021.nasl - Type : ACT_GATHER_INFO |
| 2008-12-16 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2008-1021.nasl - Type : ACT_GATHER_INFO |
| 2008-12-03 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200812-02.nasl - Type : ACT_GATHER_INFO |
| 2008-11-25 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1670.nasl - Type : ACT_GATHER_INFO |
| 2008-11-19 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_a1126054b57c11dd88920017319806e7.nasl - Type : ACT_GATHER_INFO |
| 2008-11-06 | Name : The remote Fedora host is missing a security update. File : fedora_2008-9372.nasl - Type : ACT_GATHER_INFO |
| 2008-11-06 | Name : The remote Fedora host is missing a security update. File : fedora_2008-9351.nasl - Type : ACT_GATHER_INFO |
| 2008-11-06 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_enscript-5715.nasl - Type : ACT_GATHER_INFO |
| 2008-11-06 | Name : The remote openSUSE host is missing a security update. File : suse_enscript-5719.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:52:06 |
|
