CVE-2008-3863: Buffer Overflow
Stack-based buffer overflow in the readspecialescape function in src/psgen.c in GNU Enscript 1.6.1 and 1.6.4 beta, when the -e (aka special escapes processing) option is enabled, allows user-assisted remote attackers to execute arbitrary code via a crafted ASCII file, related to the setfilename command.
Other sources
Ulf Harnhammar of the Secunia Research discovered a buffer overflow in enscript:
The vulnerability is caused due to a boundary error within the "readspecialescape()" function in src/psgen.c. This can be exploited to cause a stack-based buffer overflow by tricking the user into converting a malicious file.
Successful exploitation allows execution of arbitrary code, but requires that special escapes processing is enabled with the "-e" option.
The vulnerability is confirmed in versions 1.6.1 and 1.6.4 (beta). Other versions may also be affected.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2008-3863?
CVE-2008-3863 is a critical vulnerability due to its potential for remote code execution through a buffer overflow.
How do I fix CVE-2008-3863?
To fix CVE-2008-3863, upgrade to the patched versions of GNU Enscript: 1.6.1-33.el4_7.1 or 1.6.4-4.1.1.el5_2.
Who is affected by CVE-2008-3863?
CVE-2008-3863 affects users running GNU Enscript versions 1.6.1 and 1.6.4 beta with special escape processing enabled.
What causes the CVE-2008-3863 vulnerability?
The CVE-2008-3863 vulnerability is caused by a stack-based buffer overflow in the read_special_escape function.
Can CVE-2008-3863 be exploited remotely?
Yes, CVE-2008-3863 can be exploited remotely if a user processes a crafted ASCII file while using the vulnerable versions of Enscript.