--------------------------------------------------------------------- Fedora Legacy Update Advisory Synopsis: Updated enscript package fixes security issues Advisory ID: FLSA:152892 Issue date: 2005-12-17 Product: Red Hat Linux, Fedora Core Keywords: Bugfix CVE Names: CVE-2004-1184 CVE-2004-1185 CVE-2004-1186 --------------------------------------------------------------------- --------------------------------------------------------------------- 1. Topic: An updated enscript package that fixes several security issues is now available. GNU enscript converts ASCII files to PostScript. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 3. Problem description: Enscript has the ability to interpret special escape sequences. A flaw was found in the handling of the epsf command used to insert inline EPS files into a document. An attacker could create a carefully crafted ASCII file which made use of the epsf pipe command in such a way that it could execute arbitrary commands if the file was opened with enscript by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1184 to this issue. Additional flaws in Enscript were also discovered which can only be triggered by executing enscript with carefully crafted command line arguments. These flaws therefore only have a security impact if enscript is executed by other programs and passed untrusted data from remote users. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-1185 and CVE-2004-1186 to these issues. All users of enscript should upgrade to these updated packages, which resolve these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152892 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/enscript-1.6.1-19.73.2.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/enscript-1.6.1-19.73.2.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/enscript-1.6.1-24.2.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/enscript-1.6.1-24.2.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/enscript-1.6.1-25.1.1.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/enscript-1.6.1-25.1.1.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --------------------------------------------------------------------- ac29cc61b638a8a4a6e70642a48d4d4e7985a94c redhat/7.3/updates/i386/enscript-1.6.1-19.73.2.legacy.i386.rpm 2cc05a10d33fb0bd13cad08ae622cebbbf94ada6 redhat/7.3/updates/SRPMS/enscript-1.6.1-19.73.2.legacy.src.rpm 275eecbd654c9cc15b17e65a2c60cff8c5ec6f58 redhat/9/updates/i386/enscript-1.6.1-24.2.legacy.i386.rpm ed838a6c0f4235c789a872e880ddc5aff2d0e457 redhat/9/updates/SRPMS/enscript-1.6.1-24.2.legacy.src.rpm f1de9a957caa34766434ea5e77ad31d49ee769dd fedora/1/updates/i386/enscript-1.6.1-25.1.1.legacy.i386.rpm f73d7da391cadf7d033dfe21979fb2ae10477fc6 fedora/1/updates/SRPMS/enscript-1.6.1-25.1.1.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php You can verify each package with the following command: rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1184 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1185 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1186 9. Contact: The Fedora Legacy security contact is <secnotice@xxxxxxxxxxxxxxxx>. More project details at http://www.fedoralegacy.org ---------------------------------------------------------------------
Attachment:
signature.asc
Description: OpenPGP digital signature