oss-security - Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJ_zFkJpnGtG6D3JZVaC5KJiNzsJ6vjJK0oXRfirR8QsdFbZVQ@mail.gmail.com>
Date: Tue, 21 Aug 2018 13:12:43 -0700
From: Tavis Ormandy <taviso@...gle.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: More Ghostscript Issues: Should we disable PS
 coders in policy.xml by default?

Thanks Alex.

FWIW, not all of these are visible, but I've started filing bugs, I'll file
a few more today and then let the developers work through the most serious
ones.

699654 /invalidaccess checks stop working after a failed restore
699655 missing type checking in setcolor
699656 LockDistillerParams boolean missing type checks
699659 missing type check in type checker (!)
699657 .tempfile SAFER restrictions seem to be broken
699658 Bypassing PermitFileReading by handling undefinedfilename error
699660 shading_param incomplete type checking
699661 pdf14 garbage collection memory corruption
699662 calling .bindnow causes sideeffects
699663 .setdistillerkeys memory corruption
699664 corrupt device object after error in job

I'm working on getting reproducers working for the developers for all bugs.

On Tue, Aug 21, 2018 at 8:22 AM Alex Gaynor <alex.gaynor@...il.com> wrote:

> A small note. Both ImageMagick and GraphicsMagick process various file
> formats that can nest a different image file inside of them. These are very
> frequently implemented with a call to ReadImage(), with no checking that
> it's the expected file format. (As a result, the fuzzer finds various
> impressive chains, with sometimes 3 different image formats nested inside
> of each other).
>
> The conclusion of this is that people _must not_ attempt to do their own
> format detection and then pass the data to IM/GM, because this can be
> bypassed with nested formats. It's imperative that GS truly be disabled
> with either policy.xml or by uninstall GS.
>
> Alex
>
> On Tue, Aug 21, 2018 at 11:01 AM Bob Friesenhahn <
> bfriesen@...ple.dallas.tx.us> wrote:
>
> > On Tue, 21 Aug 2018, Tavis Ormandy wrote:
> > >
> > > I think those thumbnails should be disabled, but you've probably
> noticed
> > I
> > > think everything related to untrusted ghostscript should be disabled
> :-)
> >
> > I have posted to the GraphicsMagick Announcements mailing list
> > regarding your findings (with a link to this list) and suggested that
> > a fool-proof solution is that Ghostscript should be uninstalled.
> >
> > Uninstalling Ghostscript entirely might cause software using libgs to
> > not execute at all unless a stub library is put in its place.
> >
> > Dependencies on Ghostscript are much larger than one would initially
> > think due to Postscript being the traditional output from Unix
> > software for "printing" and thus it is used as an intermediate format
> > in order to convert between formats.  EPS content is also embedded in
> > some other formats.
> >
> > Bob
> > --
> > Bob Friesenhahn
> > bfriesen@...ple.dallas.tx.us,
> http://www.simplesystems.org/users/bfriesen/
> > GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
> >
>
>
> --
> All that is necessary for evil to succeed is for good people to do nothing.
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.