oss-security - possible vulnerability in ghostscript >= 8.64

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091218040124.GY2987@redhat.com>
Date: Thu, 17 Dec 2009 21:01:24 -0700
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: possible vulnerability in ghostscript >= 8.64

We had reported to us a crash in ghostscript's gdevcups.c, and I don't
think it can be used to do anything more than crash ghostscript,
certainly not in our configurations (compiled with FORTIFY_SOURCE).

Debug logging was added to gdevcups.c prior to the 8.64 release on Oct
17th, 2008:

http://svn.ghostscript.com/viewvc?view=rev&revision=9165

The addition of the debug logging allowed for a MediaType string to be
printed, which if longer than the 1024-byte buffer in errprintf would
cause ghostscript to crash   This is due to errprintf() and outprintf()
using vsprintf() on a fixed-length array on the stack.

This issue does not affect versions of ghostscript older than 8.64; for
8.64 and newer, if compiled using FORTIFY_SOURCE (as it is in Fedora),
this is turned into nothing more than a crash.  On a system without
FORTIFY_SOURCE, this _might_ be exploitable, but I cannot say for
certain.

As well, we can't see (in ghostscript 8.15 at least), any other calls to
errprintf() or outprintf() that use the %s specifier with user-supplied
strings (so arguably the vsprintf() calls in those functions should be
fixed, but we don't see an immediate need to do so).

I imagine that most vendors using ghostscript 8.64 or newer also have a
newer glibc and are using FORTIFY_SOURCE protection, but I can't know
that for certain, so this is a general notice that the issue exists.

Our bug report:

https://bugzilla.redhat.com/show_bug.cgi?id=540760

this had also been reported previously upstream as well:

http://bugs.ghostscript.com/show_bug.cgi?id=690829

-- 
Vincent Danen / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.