PT-2005-1132 · Gnu+1 · Enscript+1

Erik Sjolund · Publicado 2005-01-21 · Atualizado 2018-10-19 · CVE-2004-1185

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Enscript version 1.6.3

Description The issue allows remote attackers or local users to execute arbitrary commands via crafted filenames because Enscript 1.6.3 does not sanitize filenames.

Recommendations For Enscript version 1.6.3, consider implementing filename sanitization to prevent the execution of arbitrary commands. As a temporary workaround, restrict the ability to create or modify filenames to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-1185

DSA-654-1

RHSA-2005:039

RHSA-2005:040

RHSA-2005_039

RHSA-2005_040

Produtos afetados

Enscript

Red Hat

Referências · 25

• https://usn.ubuntu.com/68-1 · Aviso do Fabricante
• https://rhn.redhat.com/errata/RHSA-2005-039.html · Nota
• http://support.apple.com/kb/HT3549 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19029 · Nota
• http://debian.org/security/2005/dsa-654 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/1297 · Nota
• http://securityfocus.com/bid/12329 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2005:033 · Aviso do Fabricante
• https://redhat.com/security/data/cve/CVE-2004-1186.html · Nota
• http://us-cert.gov/cas/techalerts/TA09-133A.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10808 · Nota
• http://securityfocus.com/archive/1/435199/100/0/threaded · Nota
• http://gentoo.org/security/en/glsa/glsa-200502-03.xml · Correção, Aviso do Fabricante
• https://rhn.redhat.com/errata/RHSA-2005-040.html · Nota
• https://redhat.com/security/data/cve/CVE-2004-1184.html · Nota