Red Hat Product Errata RHSA-2008:1016 - Security Advisory
Issued:
2008-12-15
Updated:
2008-12-15

RHSA-2008:1016 - Security Advisory

Synopsis

Moderate: enscript security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An updated enscript packages that fixes several security issues is now
available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

GNU enscript converts ASCII files to PostScript(R) language files and
spools the generated output to a specified printer or saves it to a file.
Enscript can be extended to handle different output media and includes
options for customizing printouts.

Two buffer overflow flaws were found in GNU enscript. An attacker could
craft an ASCII file in such a way that it could execute arbitrary commands
if the file was opened with enscript with the "special escapes" option (-e
or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306)

All users of enscript should upgrade to these updated packages, which
contain backported patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.2 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.2 ia64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.2 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.2 s390x
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.2 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

  • BZ - 466771 - CVE-2008-3863 enscript: "setfilename" special escape buffer overflow
  • BZ - 469311 - CVE-2008-4306 enscript: "font" special escape buffer overflows

Red Hat Enterprise Linux Server 5

SRPM
enscript-1.6.4-4.1.1.el5_2.src.rpm SHA-256: 5636f05d011e37d2d44c8758488148beba72e88c8d91a76cbc2bdc4961169370
x86_64
enscript-1.6.4-4.1.1.el5_2.x86_64.rpm SHA-256: e212749dca810ce86b45bd5223c552c84ddaf74e6efc571063c42bb8301cd289
ia64
enscript-1.6.4-4.1.1.el5_2.ia64.rpm SHA-256: aca724d94ded008add4fe5794a1dc50de0f5618738fbc8f6d609cafaeebc3a5d
i386
enscript-1.6.4-4.1.1.el5_2.i386.rpm SHA-256: 6a416bfe461df77aef91bf4324513965ec1cdec81dca7a718440f90977dee77c

Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.2

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Workstation 5

SRPM
enscript-1.6.4-4.1.1.el5_2.src.rpm SHA-256: 5636f05d011e37d2d44c8758488148beba72e88c8d91a76cbc2bdc4961169370
x86_64
enscript-1.6.4-4.1.1.el5_2.x86_64.rpm SHA-256: e212749dca810ce86b45bd5223c552c84ddaf74e6efc571063c42bb8301cd289
i386
enscript-1.6.4-4.1.1.el5_2.i386.rpm SHA-256: 6a416bfe461df77aef91bf4324513965ec1cdec81dca7a718440f90977dee77c

Red Hat Enterprise Linux Desktop 5

SRPM
enscript-1.6.4-4.1.1.el5_2.src.rpm SHA-256: 5636f05d011e37d2d44c8758488148beba72e88c8d91a76cbc2bdc4961169370
x86_64
enscript-1.6.4-4.1.1.el5_2.x86_64.rpm SHA-256: e212749dca810ce86b45bd5223c552c84ddaf74e6efc571063c42bb8301cd289
i386
enscript-1.6.4-4.1.1.el5_2.i386.rpm SHA-256: 6a416bfe461df77aef91bf4324513965ec1cdec81dca7a718440f90977dee77c

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
enscript-1.6.4-4.1.1.el5_2.src.rpm SHA-256: 5636f05d011e37d2d44c8758488148beba72e88c8d91a76cbc2bdc4961169370
s390x
enscript-1.6.4-4.1.1.el5_2.s390x.rpm SHA-256: df8d0318759aa1c9fe525f6ba0ac7b5b514b50654c4d37210a6a19ce1bd0e652

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.2

SRPM
s390x

Red Hat Enterprise Linux for Power, big endian 5

SRPM
enscript-1.6.4-4.1.1.el5_2.src.rpm SHA-256: 5636f05d011e37d2d44c8758488148beba72e88c8d91a76cbc2bdc4961169370
ppc
enscript-1.6.4-4.1.1.el5_2.ppc.rpm SHA-256: 563f7a064fd6bfff0d8627b2c4cdb5b533d3ca8732be5d9c8230ef80d1546073

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.2

SRPM
ppc

Red Hat Enterprise Linux Server from RHUI 5

SRPM
enscript-1.6.4-4.1.1.el5_2.src.rpm SHA-256: 5636f05d011e37d2d44c8758488148beba72e88c8d91a76cbc2bdc4961169370
x86_64
enscript-1.6.4-4.1.1.el5_2.x86_64.rpm SHA-256: e212749dca810ce86b45bd5223c552c84ddaf74e6efc571063c42bb8301cd289
i386
enscript-1.6.4-4.1.1.el5_2.i386.rpm SHA-256: 6a416bfe461df77aef91bf4324513965ec1cdec81dca7a718440f90977dee77c

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.