[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <OgcnF5Js29vkskb2jEXrUQDCCyFPkPS44JdOSJ-scVB2WymKAmNWpE3qxCcY4u32snE5_lcl5VTQQQ0dyIfA-yN2N-ZGcXubRunexuQgxNQ=@protonmail.ch>
Date: Sat, 20 Oct 2018 11:42:20 +0000
From: Jordan Glover <Golden_Miller83@...tonmail.ch>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Attempting to patch ghostscript-9.25
‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Saturday, October 20, 2018 3:47 AM, Ken Moffat <zarniwhoop@...world.com> wrote:
> Hi,
>
> I hope people can read this - I know that google marks my mails as
> spam (so no point Cc'ing Tavis) and also that Suse discard my mails.
> Probably many other places also do that. Anyway:
>
> When the first set of vulnerabilities in 9.25 came out there was a
> nice 'mostly harmless' example, and I patched BLFS for that (needed
> one extra commit beyond the two Tavis specified, so that I could
> make sense of where to apply part of it).
>
> For the later vulnerabilities, working out what to apply has been
> much harder. Either everyone else thinks that other mitigations
> against untrusted ps files will suffice, or else it's on everybody's
> ToDo lists.
>
> So, here is a first attempt to fix all this month's vulnerabilities.
> For the latest exploit(s) I do not have an example, so I don't know
> whether or not this works. But it prevents the earlier
> vulnerability, and usage of real ps (and eps - I only have the gs
> examples, and only gs seems able to use them) seems to work
> correctly. Unlike my first attempt to fix this, which turned out
> to fail to display any ps, eps files.
>
> The patch is a bit big, so I've uploaded it to
> http://www.linuxfromscratch.org/~ken/provisional/ as
> ghostscript-9.25-security_fixes-2.patch
>
> 'provisional' until I find out if it protects adequately. If there
> turn out ot be problems, I suppose I'll need to renumber later
> versions.
>
> Built in BLFS using the same instructions as for the earlier -1
> patch [ http://www.linuxfromscratch.org/blfs/view/svn/pst/gs.html ]
> but that doesn't mean it will work for everyone else's ways of
> building. Note tht I do build the shared library.
>
> The patch lists which upstream commits I pulled in. I was mostly
> concentrating on changes to gs_init which would maybe help me apply
> the needed patches. As I've noted in the patch's introduction,
> several commits had negative offsets (I guess hunks of code were
> removed in some of the unrelated commits that I ignored).
>
> Comments welcome.
>
> One final thought - apart from 9.25, upstream seem to have an
> approximately 6-monthly release schedule, so probably the only thing
> likely to speed up 9.26 is everybody patching ;)
>
> ĸen
I think the easiest way is to build on upstream git snapshot.
All of its contents will be included in future release anyway.
Jordan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
