Critical Flaws in Ghostscript Could Leave Many Systems at Risk of Hacking
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-8291 | Ghostscript Type Confusion Flaw Enables Command Execution via Crafted EPS Files Ghostscript versions through 2017-04-26 contain a type confusion flaw (CWE-843) in the .rsdparams routine that also permits bypass of the -dSAFER security sandbox. The flaw is triggered when the gs program processes a crafted .eps (PostScript) document containing a "/OutputFile (%pipe%" substring, which causes Ghostscript to execute embedded operating system commands. An attacker gains command execution with the privileges of the gs process, which commonly runs in document-conversion pipelines, print servers, and image-processing tools such as ImageMagick. Users of upstream Ghostscript and distributions that ship it, notably Debian and Red Hat Enterprise Linux desktop, server, and workstation variants, are affected. The flaw was exploited in the wild in April 2017, was added to the CISA Known Exploited Vulnerabilities catalog on 2022-05-24, and carries a 97% EPSS probability of exploitation. Do: Apply the Ghostscript fixes released after 2017-04-26 per your distribution's security advisories (Debian, Red Hat) and upstream Artifex updates, as required by CISA's KEV listing. As interim mitigation, avoid processing untrusted EPS/PostScript files with gs, including indirect processing via ImageMagick/convert pipelines and print servers, since the %pipe% OutputFile trick executes shell commands. Inventory systems that run Ghostscript for server-side document or image conversion, as those face the greatest exposure. | 7.8 | 97% | KEV PoC ×2 |
| masstens of millions of installations (Ghostscript is a default component in most major Linux distributions) |
Full article390 words · extracted from thehackernews.com · click to collapse
The Hacker NewsAug 22, 2018
Google Project Zero's security researcher has discovered a critical remote code execution (RCE) vulnerability in Ghostscript—an open source interpreter for Adobe Systems' PostScript and PDF page description languages.
Written entirely in C, Ghostscript is a package of software that runs on different platforms, including Windows, macOS, and a wide variety of Unix systems, offering software the ability to convert PostScript language files (or EPS) to many raster formats, such as PDF, XPS, PCL or PXL.
A lot of popular PDF and image editing software, including ImageMagick and GIMP, use Ghostscript library to parse the content and convert file formats.
Ghostscript suite includes a built-in -dSAFER sandbox protection option that handles untrusted documents, preventing unsafe or malicious PostScript operations from being executed.
However, Google Project Zero team researcher Tavis Ormandy discovered that Ghostscript contains multiple -dSAFER sandbox bypass vulnerabilities, which could allow a remote, unauthenticated attacker to execute arbitrary commands on a vulnerable system.
To exploit this vulnerability, all an attacker needs to do is sending a specially crafted malicious file (which could be a PDF, PS, EPS, or XPS) to a victim, which, if opened with an application leveraging vulnerable Ghostscript, could allow the attacker to completely take over the targeted system.
At the time of writing, Artifex Software, the maintainers of Ghostscript, have not released any patch to fix the vulnerability.
According to advisory released by US-CERT, applications like the ImageMagick image processing library, which uses Ghostscript by default to process PostScript content, are affected by the vulnerability.
Major Linux distributions including RedHat and Ubuntu have confirmed that they are also affected by this vulnerability, while the status for Arch Linux, CentOS, Debian, Dell, Apple, and others is still unknown.
Ormandy advised Linux distributions to disable the processing of PS, EPS, PDF, and XPS content until the issue is addressed.
"I *strongly* suggest that distributions start disabling PS, EPS, PDF and XPS coders in policy.xml by default," Ormandy said.
This is not the first time when Ormandy has discovered issues in Ghostscript. He found similar high severity vulnerabilities in Ghostscript in October 2016 and April last year (CVE-2017-8291), some of which were found actively exploited in the wild.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2018/08/ghostscript-postscript-vulnerability.html