[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 30 May 2010 22:08:12 +0200
From: "Bernhard R. Link" <brlink@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: ghostscript and gv
* Florian Weimer <fw@...eb.enyo.de> [100530 21:53]:
> "gs -P- -DSAFER gs_init.ps" works, too, so you can inject the payload
> with file-name-preserving user agents. 8-(
>
> Is the general consensus that we should patch this in
> viewers/Ghostscript wrappers, and not Ghostscript itself?
For Gv there is also the issue with pdf2dsc.ps (and the Debian lenny
version with the temporary filei creation stuff), so it needs to be fixed
anyway.
Gs's -P- not working (at least for gs_init.ps), is definitly a bug that
needs to be fixed.
I personally would also suggest fixing gs to not look in the current
directory by default (looking for important stuff in the current
directory is really always a bad idea). I guess the problem is how to
fix it.
I think (though I am not really sure) a gs that has -P- activated by
default would for example break pdf viewing of gv versions 3.6.2 to
3.6.5.91, because (I think) -P- also causes files in the current
directory can no longer be opened from other postscript files with
-dSAFER and the gv versions above only use -dSAFER and not -dDELAYSAFER
as it would need for pdf2dsc.ps generated files. (I think -P- already
has that effect, even though it has no effect on gs_init.ps).
Bernhard R. Link
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
