Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?

[Mateusz Lenik <mlen () mlen pl>]

Hello,

On Thu, Aug 23, 2018 at 11:06 AM Leonardo Taccari <iamleot () gmail com> wrote:

> Bob Friesenhahn writes:
> > The CERT advisory at https://www.kb.cert.org/vuls/id/332928 provides a
> > policy.xml example which does not appear to block PS2 and PS3, which
> > are also entry points for reading Postscript.
> > [...]
>
> If I am not missing something I think that ghostscript isn't used
> for them though.

It seems to be possible to disable GhostScript in ImageMagick completely by
the policy rule below. It's not possible to miss any format with it.

<policy domain="delegate" rights="none" pattern="gs" />

I also found out that Amit's exploit works with lesspipe that ships with
less by default -- it uses gs via ps2ascii wrapper

Best,
Mateusz