oss-security - Re: Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190122155216.4fx6xh3tlohmxe3n@storm.m.i2n>
Date: Tue, 22 Jan 2019 16:52:16 +0100
From: Thomas Jarosch <thomas.jarosch@...ra2net.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: ghostscript: 1Policy operator gives access to
 .forceput CVE-2018-18284

Hi,

You wrote on Thu, Oct 18, 2018 at 01:25:29PM +0000:
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Thursday, October 18, 2018 2:32 PM, Tavis Ormandy <taviso@...gle.com> wrote:
> 
> > On Thu, Oct 18, 2018 at 3:51 AM Jordan Glover <Golden_Miller83@...tonmail.ch> wrote:
> >
> >> Do you know if upstream is going to make new release soon or distros should take the
> >> pain and backport all of those themselves?
> >
> > AFAIK upstream only makes quarterly releases, so I think you need to backport.
> >
> > Tavis.
> 
> In normal, boring times yes but 9.25 was available just 10 days after 9.24 as urgent security
> release and it seems it was still not enough.

just a quick follow up: ghostscript 9.26 was released on 2018-11-20
and fixes the issue demonstrated by the exploit posted in:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1696

*******************************************
# gs executeonly-bypass.pdf 
GPL Ghostscript 9.26 (2018-11-20)
Copyright (C) 2018 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
what do we want?
        deprecate untrusted postscript!
when do we want it?
        now!
Error: /undefined in .policyprocs
Operand stack:
   --dict:967/1684(ro)(G)--   SAFER   false   --dict:0/0(L)--   --dict:0/0(L)--  
 --dict:967/1684(ro)(G)--   (ignored)   SAFER   false
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   
--nostringval--   2   %stopped_push   --nostringval--   --nostringval--   
--nostringval--   false   1   %stopped_push   2029   1   3   %oparray_pop   2028 
  1   3   %oparray_pop   2009   1   3   %oparray_pop   1868   1   3   
%oparray_pop   --nostringval--   %errorexec_pop   .runexec2   --nostringval--   
--nostringval--   --nostringval--   2   %stopped_push   --nostringval--   
--nostringval--
Dictionary stack:
   --dict:967/1684(ro)(G)--   --dict:0/20(G)--   --dict:79/200(L)--
Current allocation mode is local
Current file position is 575
GPL Ghostscript 9.26: Unrecoverable error, exit code 1
*******************************************

The release timeline of the vendor Artifex is also quite good:

9.24: 2018-09-03
9.25: 2018-09-13
9.26: 2018-11-20

Fedora 28 is f.e. still vulnerable though.

Best regards,
Thomas Jarosch

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.