FreeBSD : enscript -- arbitrary code execution vulnerability (a1126054-b57c-11dd-8892-0017319806e7)

NASLDB: FreeBSD : enscript -- arbitrary code execution vulnerability (a1126054-b57c-11dd-8892-0017319806e7)

General

ID: 34817
Name: FreeBSD : enscript — arbitrary code execution vulnerability (a1126054-b57c-11dd-8892-0017319806e7)

Summary: Checks for updated packages in pkg_info output

Credits: Tenable Network Security, Inc.

Classification

Risk: –

CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Temporal Vector: –

Port: 0
Family: FreeBSD Local Security Checks
Type: Local

Description

Ulf Harnhammar of Secunia Research reports :

Stack-based buffer overflow in the read_special_escape function in
src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka
special escapes processing) option is enabled, allows user-assisted
remote attackers to execute arbitrary code via a crafted ASCII file,
related to the setfilename command.

Exploiting

Exploit Available: –
Exploitability Ease: –

Sources

CVE: CVE-2008-3863
OSVDB: –
Bugtraq: –
scipID: –

Timeline

Vulnerability Disclosure: 2008/10/22
Patch Release: 2008/11/18
Plugin Release: 2008/11/19

Plugin

Version: 1.11
Filename: freebsd_pkg_a1126054b57c11dd88920017319806e7.nasl
Filesize: 4584 bytes
MD5 Hash: de32c87a756d75834ca4e77dfc7a8fec

Identification: Host/local_checks_enabled
Require Keys: Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info
Dependencies: "ssh_get_info.nasl"