Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 9 Oct 2018 18:26:43 -0400
From: "Perry E. Metzger" <perry@...rmont.com>
To: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
Cc: oss-security@...ts.openwall.com
Subject: Re: ghostscript: bypassing executeonly to escape
 -dSAFER sandbox (CVE-2018-17961)

On Tue, 9 Oct 2018 17:14:45 -0500 (CDT) Bob Friesenhahn
<bfriesen@...ple.dallas.tx.us> wrote:
> On Tue, 9 Oct 2018, Tavis Ormandy wrote:
> >
> > I think we should encourage switching to other document formats
> > that we have a better handle on securing. If you do need
> > untrusted ps, I think treating it the same as shell script file
> > you downloaded from the internet.  
> 
> Due to its valuable current usages (e.g. printing and format 
> conversion) and its long legacy, Postscript is still a vital format
> to support in open source software.
> 
> How can software consuming Postscript be aware of its origin unless
> it is known to be produced directly by another application?
> 
> Edge applications such as web browsers may be able to help by
> adding warning dialogs when knowingly downloading Postscript
> content.

I keep wondering if there isn't a way to fully remove the dangerous
bits from a postscript interpreter so it can _only_ be used to view
the document and literally has no file system access compiled in at
all, so there's no way to touch the fs etc. regardless of what flags
the interpreter is invoked with.

(I, too, find removing the ability to look at historical postscript
documents a bit more draconian than I like.)

Perry
-- 
Perry E. Metzger		perry@...rmont.com

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.