Vulnerabilities > CVE-2004-1170

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
gnu
sun
suse
critical
nessus
exploit available
NVD
Published: 2005-01-10
Updated: 2018-10-19

Summary

a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.

Vulnerable Configurations

Part Description Count
Application
Gnu
2
Application
Sun
2
OS
Suse
7

Exploit-Db

descriptionGNU a2ps 4.13 File Name Command Execution Vulnerability. CVE-2004-1170. Local exploit for linux platform
idEDB-ID:24406
last seen2016-02-02
modified2004-08-24
published2004-08-24
reporterRudolf Polzer
sourcehttps://www.exploit-db.com/download/24406/
titleGNU a2ps 4.13 File Name Command Execution Vulnerability

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-612.NASL
    descriptionRudolf Polzer discovered a vulnerability in a2ps, a converter and pretty-printer for many formats to PostScript. The program did not escape shell meta characters properly which could lead to the execution of arbitrary commands as a privileged user if a2ps is installed as a printer filter.
    last seen2020-06-01
    modified2020-06-02
    plugin id16008
    published2004-12-20
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/16008
    titleDebian DSA-612-1 : a2ps - unsanitised input
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200501-02.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200501-02 (a2ps: Multiple vulnerabilities) Javier Fernandez-Sanguino Pena discovered that the a2ps package contains two scripts that create insecure temporary files (fixps and psmandup). Furthermore, we fixed in a previous revision a vulnerability in a2ps filename handling (CAN-2004-1170). Impact : A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When fixps or psmandup is executed, this would result in the file being overwritten with the rights of the user running the utility. By enticing a user or script to run a2ps on a malicious filename, an attacker could execute arbitrary commands on the system with the rights of that user or script. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id16393
    published2005-02-14
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/16393
    titleGLSA-200501-02 : a2ps: Multiple vulnerabilities
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_8091FCEAF35E11D881B0000347A4FA7D.NASL
    descriptionRudolf Polzer reports : a2ps builds a command line for file() containing an unescaped version of the file name, thus might call external programs described by the file name. Running a cronjob over a public writable directory a2ps-ing all files in it - or simply typing
    last seen2020-06-01
    modified2020-06-02
    plugin id37951
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/37951
    titleFreeBSD : a2ps -- insecure command line argument handling (8091fcea-f35e-11d8-81b0-000347a4fa7d)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2004-140.NASL
    descriptionThe GNU a2ps utility fails to properly sanitize filenames, which can be abused by a malicious user to execute arbitrary commands with the privileges of the user running the vulnerable application. The updated packages have been patched to prevent this problem.
    last seen2020-06-01
    modified2020-06-02
    plugin id15838
    published2004-11-27
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/15838
    titleMandrake Linux Security Advisory : a2ps (MDKSA-2004:140)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_A2PS_413B2.NASL
    descriptionThe following package needs to be updated: a2ps-a4
    last seen2016-09-26
    modified2011-10-03
    plugin id15524
    published2004-10-20
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=15524
    titleFreeBSD : a2ps -- insecure command line argument handling (4)

Statements

contributorMark J Cox
lastmodified2007-03-14
organizationRed Hat
statementRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

References