[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALDAOtuLdurT759O0AxPovJ4ThgcrYrJkYsxJPR4EgWf2QG_+g@mail.gmail.com>
Date: Thu, 23 Aug 2018 13:29:23 +0200
From: Mateusz Lenik <mlen@...n.pl>
To: oss-security@...ts.openwall.com
Subject: Re: Re: More Ghostscript Issues: Should we disable PS
coders in policy.xml by default?
Hello,
On Thu, Aug 23, 2018 at 11:06 AM Leonardo Taccari <iamleot@...il.com> wrote:
> Bob Friesenhahn writes:
> > The CERT advisory at https://www.kb.cert.org/vuls/id/332928 provides a
> > policy.xml example which does not appear to block PS2 and PS3, which
> > are also entry points for reading Postscript.
> > [...]
>
> If I am not missing something I think that ghostscript isn't used
> for them though.
>
It seems to be possible to disable GhostScript in ImageMagick completely by
the policy rule below. It's not possible to miss any format with it.
<policy domain="delegate" rights="none" pattern="gs" />
I also found out that Amit's exploit works with lesspipe that ships with
less by default -- it uses gs via ps2ascii wrapper
Best,
Mateusz
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
