Date: Sat, 20 Oct 2018 02:47:01 +0100 From: Ken Moffat <zarniwhoop@...world.com> To: oss-security@...ts.openwall.com Subject: Attempting to patch ghostscript-9.25 Hi, I hope people can read this - I know that google marks my mails as spam (so no point Cc'ing Tavis) and also that Suse discard my mails. Probably many other places also do that. Anyway: When the first set of vulnerabilities in 9.25 came out there was a nice 'mostly harmless' example, and I patched BLFS for that (needed one extra commit beyond the two Tavis specified, so that I could make sense of where to apply part of it). For the later vulnerabilities, working out what to apply has been much harder. Either everyone else thinks that other mitigations against untrusted ps files will suffice, or else it's on everybody's ToDo lists. So, here is a first attempt to fix all this month's vulnerabilities. For the latest exploit(s) I do not have an example, so I don't know whether or not this works. But it prevents the earlier vulnerability, and usage of real ps (and eps - I only have the gs examples, and only gs seems able to use them) seems to work correctly. Unlike my first attempt to fix this, which turned out to fail to display any ps, eps files. The patch is a bit big, so I've uploaded it to http://www.linuxfromscratch.org/~ken/provisional/ as ghostscript-9.25-security_fixes-2.patch 'provisional' until I find out if it protects adequately. If there turn out ot be problems, I suppose I'll need to renumber later versions. Built in BLFS using the same instructions as for the earlier -1 patch [ http://www.linuxfromscratch.org/blfs/view/svn/pst/gs.html ] but that doesn't mean it will work for everyone else's ways of building. Note tht I _do_ build the shared library. The patch lists which upstream commits I pulled in. I was mostly concentrating on changes to gs_init which would maybe help me apply the needed patches. As I've noted in the patch's introduction, several commits had negative offsets (I guess hunks of code were removed in some of the unrelated commits that I ignored). Comments welcome. One final thought - apart from 9.25, upstream seem to have an approximately 6-monthly release schedule, so probably the only thing likely to speed up 9.26 is everybody patching ;) ĸen -- Is it about a bicycle ?
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.