Date: Wed, 5 Sep 2018 11:02:48 -0700 From: Tavis Ormandy <taviso@...gle.com> To: oss-security@...ts.openwall.com Subject: Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Quick update, this <http://git.ghostscript.com/?p=ghostpdl.git&a=commitdiff&h=5812b1b78fc4> commit fixes that problem, but I noticed that fix is incomplete and can be bypassed, so filed another bug for that (the new bug is 699718). $ ./gs -dSAFER bug699718.txt GPL Ghostscript GIT PRERELEASE 9.25 (2018-09-03) Copyright (C) 2018 Artifex Software, Inc. All rights reserved. This software comes with NO WARRANTY: see the file PUBLIC for details. uid=1000(taviso) gid=1000(primarygroup) I would like to re-emphasize that while Ghostscript is very capable and mature software, I consider the -dSAFER sandbox to be a fragile security boundary and that we should consider deprecating (or minimizing the use of) untrusted postscript. Tavis. On Tue, Sep 4, 2018 at 1:08 PM Tavis Ormandy <taviso@...gle.com> wrote: > > > On Tue, Sep 4, 2018 at 1:03 PM Brandon Perry <bperry.volatile@...il.com> > wrote: > >> >> >> > On Sep 4, 2018, at 2:59 PM, Tavis Ormandy <taviso@...gle.com> wrote: >> > >> > OK, well, the fixes missed 9.24 so vendors will have to either ship >> patches >> > once they land or wait for 9.25. >> > >> > $ ./gs -v >> > GPL Ghostscript 9.24 (2018-09-03) >> > Copyright (C) 2018 Artifex Software, Inc. All rights reserved. >> > $ ./gs -q -dSAFER -sDEVICE=ppmraw -f testcase.ps >> > uid=1000(taviso) gid=1000(taviso) >> > >> > Let me know if anyone wants that testcase. >> >> Hey Tavis, could I have a copy of the test case please? Thanks so much. >> > > Sure, here it is. > > Thanks, Tavis. > >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.