oss-security - Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 5 Sep 2018 11:02:48 -0700
From: Tavis Ormandy <taviso@...gle.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: More Ghostscript Issues: Should we disable PS
 coders in policy.xml by default?

Quick update, this
<http://git.ghostscript.com/?p=ghostpdl.git&a=commitdiff&h=5812b1b78fc4>
commit fixes that problem, but I noticed that fix is incomplete and can be
bypassed, so filed another bug for that (the new bug is 699718).

$ ./gs -dSAFER bug699718.txt
GPL Ghostscript GIT PRERELEASE 9.25 (2018-09-03)
Copyright (C) 2018 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
uid=1000(taviso) gid=1000(primarygroup)

I would like to re-emphasize that while Ghostscript is very capable and
mature software, I consider the -dSAFER sandbox to be a fragile security
boundary and that we should consider deprecating (or minimizing the use of)
untrusted postscript.

Tavis.

On Tue, Sep 4, 2018 at 1:08 PM Tavis Ormandy <taviso@...gle.com> wrote:

>
>
> On Tue, Sep 4, 2018 at 1:03 PM Brandon Perry <bperry.volatile@...il.com>
> wrote:
>
>>
>>
>> > On Sep 4, 2018, at 2:59 PM, Tavis Ormandy <taviso@...gle.com> wrote:
>> >
>> > OK, well, the fixes missed 9.24 so vendors will have to either ship
>> patches
>> > once they land or wait for 9.25.
>> >
>> > $ ./gs -v
>> > GPL Ghostscript 9.24 (2018-09-03)
>> > Copyright (C) 2018 Artifex Software, Inc.  All rights reserved.
>> > $ ./gs -q -dSAFER -sDEVICE=ppmraw -f testcase.ps
>> > uid=1000(taviso) gid=1000(taviso)
>> >
>> > Let me know if anyone wants that testcase.
>>
>> Hey Tavis, could I have a copy of the test case please? Thanks so much.
>>
>
> Sure, here it is.
>
> Thanks, Tavis.
>
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.