bugtraq - Re: Ghostscript 8.64 executes random code at startup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201005261112.22262.giecrilj@stegny.2a.pl>
Date: Wed, 26 May 2010 11:12:22 +0200
From: Krzysztof Żelechowski <giecrilj@...gny.2a.pl>
To: paul.szabo@...ney.edu.au
Cc: bugtraq@...urityfocus.com, ne01026@...gny.2a.pl
Subject: Re: Ghostscript 8.64 executes random code at startup

Dnia środa, 26 maja 2010 o 04:32:51 paul.szabo@...ney.edu.au napisał(a):
> Dear Christopher,
> 
> > Ghostscript_8.64 on openSuSE_11.2 executes all files matching
> > ./Encoding/* on startup.  This search is relative to the current
> > directory so it is easy to poison Ghostscript and cause it to execute
> > arbitrary PostScript code without user action or knowledge.
> >
> > Details: <URL:https://bugzilla.novell.com/show_bug.cgi?id=608071>
> 
> Interesting! So if someone creates /tmp/Encoding then it is dangerous
> to do
>   cd /tmp; gs any.ps
> 
> I now used:
>   strace -omylog gs
>   grep '"\./' mylog | sort -u
> and that shows that gs tries many files in currrent directory,
> "protection" against just ./Encoding is not enough.

What is in the file "any.ps"?

You are exposed to the Encoding vulnerability without feeding *anything* to 
Ghostscript:

cd /tmp
gs
Bang!