CVE-2008-3863
published 2008-10-23CVE-2008-3863: Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes…
PriorityP341high7.6CVSS 2.0
AVNACHAuNCCICAC
EPSS
8.36%
94.3th percentile
Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | enscript | < enscript 1.6.4-13 (bookworm) | enscript 1.6.4-13 (bookworm) |
| gnu | enscript | — | — |
| gnu | enscript | — | — |
| gnu | enscript | >= 0 < 1.6.4-13 | 1.6.4-13 |
| gnu | enscript | >= 0 < 1.6.4-13 | 1.6.4-13 |
| gnu | enscript | >= 0 < 1.6.4-13 | 1.6.4-13 |
| gnu | enscript | >= 0 < 1.6.4-13 | 1.6.4-13 |
CVSS provenance
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
osv7.6HIGH
vendor_debian7.6HIGH
vendor_redhat7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
enscript vulnerability
vendor_ubuntu·2008-11-03
CVE-2008-3863 enscript vulnerability
Title: enscript vulnerability
Summary: enscript vulnerability
Ulf Härnhammar discovered multiple stack overflows in enscript's handling of
special escape arguments. If a user or automated system were tricked into
processing a malicious file with the "-e" option enabled, a remote attacker
could execute arbitrary code or cause enscript to crash, possibly leading
to a denial of service.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Red Hat
enscript: "setfilename" special escape buffer overflow
vendor_redhat·2008-10-22·CVSS 7.6
CVE-2008-3863 [HIGH] enscript: "setfilename" special escape buffer overflow
enscript: "setfilename" special escape buffer overflow
Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.
Debian
CVE-2008-3863: enscript - Stack-based buffer overflow in the read_special_escape function in src/psgen.c i...
vendor_debian·2008·CVSS 7.6
CVE-2008-3863 [HIGH] CVE-2008-3863: enscript - Stack-based buffer overflow in the read_special_escape function in src/psgen.c i...
Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.
Scope: local
bookworm: resolved (fixed in 1.6.4-13)
bullseye: resolved (fixed in 1.6.4-13)
forky: resolved (fixed in 1.6.4-13)
sid: resolved (fixed in 1.6.4-13)
trixie: resolved (fixed in 1.6.4-13)
GHSA
GHSA-wp92-87r8-55v9: Stack-based buffer overflow in the read_special_escape function in src/psgen
ghsa_unreviewed·2022-05-02
CVE-2008-3863 [HIGH] CWE-119 GHSA-wp92-87r8-55v9: Stack-based buffer overflow in the read_special_escape function in src/psgen
Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.
OSV
CVE-2008-3863: Stack-based buffer overflow in the read_special_escape function in src/psgen
osv·2008-10-23·CVSS 7.6
CVE-2008-3863 [HIGH] CVE-2008-3863: Stack-based buffer overflow in the read_special_escape function in src/psgen
Stack-based buffer overflow in the read_special_escape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2008-5078 enscript: "epsf" special escape buffer overflows
bugzilla·2008-12-01·CVSS 7.6
CVE-2008-5078 [HIGH] CVE-2008-5078 enscript: "epsf" special escape buffer overflows
CVE-2008-5078 enscript: "epsf" special escape buffer overflows
While preparing updates for CVE-2008-3863 and CVE-2008-4306, we have discovered that enscript 1.6.1 (and possibly earlier versions) is affected by similar flaws affecting handling of epsf special escape.
Long file name specified as an argument for epsf special escape can cause buffer overflow in recognize_eps_file() in src/psgen.c, or in tilde_subst() in src/util.c due to unsafe use of strcpy or sprintf.
Identified flaws do not affect enscript 1.6.4.
Discussion:
Created attachment 325251
Patch for enscript 1.6.1 for CVE-2008-3863, CVE-2008-4306 and CVE-2008-5078
It also prevents few command line arguments parsing overflow, but those are not security flaws (no trust boundary crossed).
---
Created attachment 325695
Improv
Bugzilla
CVE-2008-4306 enscript: "font" special escape buffer overflows
bugzilla·2008-10-31·CVSS 7.6
CVE-2008-4306 [HIGH] CVE-2008-4306 enscript: "font" special escape buffer overflows
CVE-2008-4306 enscript: "font" special escape buffer overflows
Kees Cook and Tomas Hoger discovered multiple buffer overflows in enscript related to handling of the font{} special escape caused by an unsafe use of strcpy(). This can be exploited to cause a stack-based buffer overflow by tricking the user into converting a malicious file, , but requires that special escapes processing is enabled with the "-e" option (not enabled by default).
Issue is similar to recently reported setfilename{} special escape handling buffer overflow known as CVE-2008-3863.
Discussion:
Created attachment 322030
Proposed patch from Kees Cook (Ubuntu)
---
Created attachment 322031
Escape array indexing typo
While testing this, another minor typo was discovered in the escapes array indexing in the error c
Bugzilla
CVE-2008-3863 enscript: "setfilename" special escape buffer overflow
bugzilla·2008-10-13·CVSS 7.6
CVE-2008-3863 [HIGH] CVE-2008-3863 enscript: "setfilename" special escape buffer overflow
CVE-2008-3863 enscript: "setfilename" special escape buffer overflow
Ulf Harnhammar of the Secunia Research discovered a buffer overflow in enscript:
The vulnerability is caused due to a boundary error within the
"read_special_escape()" function in src/psgen.c. This can be exploited
to cause a stack-based buffer overflow by tricking the user into
converting a malicious file.
Successful exploitation allows execution of arbitrary code, but requires
that special escapes processing is enabled with the "-e" option.
The vulnerability is confirmed in versions 1.6.1 and 1.6.4 (beta). Other
versions may also be affected.
Discussion:
Public now via:
http://secunia.com/secunia_research/2008-41/
---
Additional references:
http://www.securityfocus.com/archive/1/archive/1/497647/100/0/threaded
http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.htmlhttp://rhn.redhat.com/errata/RHSA-2008-1021.htmlhttp://secunia.com/advisories/32137http://secunia.com/advisories/32521http://secunia.com/advisories/32530http://secunia.com/advisories/32753http://secunia.com/advisories/32854http://secunia.com/advisories/32970http://secunia.com/advisories/33109http://secunia.com/advisories/35074http://secunia.com/secunia_research/2008-41/http://security.gentoo.org/glsa/glsa-200812-02.xmlhttp://securityreason.com/securityalert/4488http://support.apple.com/kb/HT3549http://support.avaya.com/elmodocs2/security/ASA-2008-504.htmhttp://wiki.rpath.com/wiki/Advisories:rPSA-2008-0321http://www.debian.org/security/2008/dsa-1670http://www.mandriva.com/security/advisories?name=MDVSA-2008:243http://www.redhat.com/support/errata/RHSA-2008-1016.htmlhttp://www.securityfocus.com/archive/1/497647/100/0/threadedhttp://www.securityfocus.com/archive/1/498385/100/0/threadedhttp://www.securityfocus.com/bid/31858http://www.ubuntu.com/usn/usn-660-1http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlhttp://www.vupen.com/english/advisories/2008/2891http://www.vupen.com/english/advisories/2009/1297https://exchange.xforce.ibmcloud.com/vulnerabilities/46026https://issues.rpath.com/browse/RPL-2887https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9939https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00014.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-November/msg00040.htmlhttp://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.htmlhttp://rhn.redhat.com/errata/RHSA-2008-1021.htmlhttp://secunia.com/advisories/32137http://secunia.com/advisories/32521http://secunia.com/advisories/32530http://secunia.com/advisories/32753http://secunia.com/advisories/32854http://secunia.com/advisories/32970http://secunia.com/advisories/33109http://secunia.com/advisories/35074http://secunia.com/secunia_research/2008-41/http://security.gentoo.org/glsa/glsa-200812-02.xmlhttp://securityreason.com/securityalert/4488http://support.apple.com/kb/HT3549http://support.avaya.com/elmodocs2/security/ASA-2008-504.htmhttp://wiki.rpath.com/wiki/Advisories:rPSA-2008-0321http://www.debian.org/security/2008/dsa-1670http://www.mandriva.com/security/advisories?name=MDVSA-2008:243http://www.redhat.com/support/errata/RHSA-2008-1016.htmlhttp://www.securityfocus.com/archive/1/497647/100/0/threadedhttp://www.securityfocus.com/archive/1/498385/100/0/threadedhttp://www.securityfocus.com/bid/31858http://www.ubuntu.com/usn/usn-660-1http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlhttp://www.vupen.com/english/advisories/2008/2891http://www.vupen.com/english/advisories/2009/1297https://exchange.xforce.ibmcloud.com/vulnerabilities/46026https://issues.rpath.com/browse/RPL-2887https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9939https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00014.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-November/msg00040.html
2008-10-23
Published