[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20180905233220.GK1664@takahe.colorado.edu>
Date: Wed, 5 Sep 2018 17:32:20 -0600
From: Leonid Isaev <leonid.isaev@...a.colorado.edu>
To: oss-security@...ts.openwall.com
Subject: Re: Re: More Ghostscript Issues: Should we disable PS
coders in policy.xml by default?
On Wed, Sep 05, 2018 at 03:13:53PM -0400, Stuart Gathman wrote:
> Postscript is a general purpose programming language. It can do
> anything to your system that a C or Python program could. The SAFER
> sandbox was supposed to be able to prevent untrusted postscript code
> from doing serious damage. But this series of bugs shows that the
> sandbox is very flawed, and running untrusted postscript relying only on
> the SAFER sandbox is a very bad idea.
>
> What I need to study, is whether random PDF files from the internet (as
> opposed to general postscript) are therefore malware vectors. I thought
> that PDF used a restricted subset of operations that "rendered" it not a
> general purpose language and therefore "safe". But if SAFER was the
> implementation of that restricted subset, then all internet PDFs are
> suspect.
In addition to that, pdf files can contains things like javascript... There are
some python tools to analyze them and detect (even obfuscated JS) -- see [1]
and links therein. But yes, unless you generate a pdf/ps file yourself (e.g.
with pdflatex or a graphics program), you should consider it untrusted.
Cheers,
L.
[1] https://stackoverflow.com/questions/29342542/how-can-i-extract-a-javascript-from-a-pdf-file-with-a-command-line-tool
--
Leonid Isaev
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
