Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?

[Bob Friesenhahn <bfriesen () simple dallas tx us>]

On Wed, 22 Aug 2018, Leonardo Taccari wrote:

> Hello Bob,
>
> Bob Friesenhahn writes:
> > The CERT advisory at https://www.kb.cert.org/vuls/id/332928 provides a
> > policy.xml example which does not appear to block PS2 and PS3, which
> > are also entry points for reading Postscript.
> > [...]
>
> If I am not missing something I think that ghostscript isn't used
> for them though.

You are missing something.  While they are unlikely to be triggered by 
default (but still could be triggered by an attacker with sufficient 
control), testing shows that

  convert -verbose PS2:file.ps outfile.png
  convert -verbose file.ps2 outfile.png
  convert -verbose PS3:file.ps outfile.png
  convert -verbose file.ps3 outfile.png

does in fact invoke Ghostscript.

Bob
--
Bob Friesenhahn
bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/