[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1808230753470.3841@freddy.simplesystems.org>
Date: Thu, 23 Aug 2018 07:58:51 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: Re: More Ghostscript Issues: Should we disable
PS coders in policy.xml by default?
On Wed, 22 Aug 2018, Leonardo Taccari wrote:
> Hello Bob,
>
> Bob Friesenhahn writes:
>> The CERT advisory at https://www.kb.cert.org/vuls/id/332928 provides a
>> policy.xml example which does not appear to block PS2 and PS3, which
>> are also entry points for reading Postscript.
>> [...]
>
> If I am not missing something I think that ghostscript isn't used
> for them though.
You are missing something. While they are unlikely to be triggered by
default (but still could be triggered by an attacker with sufficient
control), testing shows that
convert -verbose PS2:file.ps outfile.png
convert -verbose file.ps2 outfile.png
convert -verbose PS3:file.ps outfile.png
convert -verbose file.ps3 outfile.png
does in fact invoke Ghostscript.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
