Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?

[Tavis Ormandy <taviso () google com>]

Here is an update, Artifex made a press release
<https://www.darkreading.com/prnewswire2.asp?rkey=20180824UN89145&filter=3930>
listing
some necessary commits, but the list was incomplete.

Here is a list of relevant commits I'm aware of so far, some issues are
still open with working exploits available. It's my understanding that no
new release is planned until late September, and vendors need to either
ship a git snapshot when all issues are resolved, or apply patches. I have
testcases for each problem, but I think the bugs will be visible eventually
so I'm not posting them here.

http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ea735ba37dc0fd5f5622d031830b9a559dec1cc9
# 699671
handling /undefined results in SEGV
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0edd3d6c63
# 699659 missing type check in ztype
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=78911a01b6 #
699654 A /invalidaccess checks stop working after a failed restore
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5516c614dc33 #
699654 B /invalidaccess checks stop working after a failed restore
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=79cccf641486 #
699654 C /invalidaccess checks stop working after a failed restore
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b326a716 # 699655
- missing type checking in setcolor
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=c3476dde # 699656
- LockDistillerParams boolean missing type checks
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a054156d42
# 699658 - Bypassing PermitFileReading by handling undefinedfilename errors
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0b6cd1918e1ec4ffd087400a754a845180a4522b
# 699660 - shading_param incomplete type checking
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=e01e77a36cbb2e0277bc3a63852244bec41be0f6
# 699660 - shading_param incomplete type checking
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=c432131c3f
# 699661 - pdf14 garbage collection memory corruption
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=971472c83a345a16dac9f90f91258bb22dd77f22
# 699663 - .setdistillerkeys memory corruption
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=241d911127
# 699664 - corrupt device object after error in job
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0d3901189f
# 699657 - .tempfile SAFER restrictions seem to be broken
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=8e9ce5016db968b40e4ec255a3005f2786cce45f
# 699665 - memory corruption in aesdecode
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b575e1ec42
# 699668 - .definemodifiedfont memory corruption if /typecheck is handled

Tavis

On Thu, Aug 23, 2018 at 8:05 AM Bob Friesenhahn <
bfriesen () simple dallas tx us> wrote:

> On Thu, 23 Aug 2018, Leonardo Taccari wrote:
> > (Regarding the `file.ps2' and `file.ps3' examples without `PS2:' or
> > `PS3:' prefixes according `convert -debug Policy -log "%e"' it seems
> > that they ends up as:
> >
> > Domain: Coder; rights=Read; pattern="PS" ...
> >
> > ...so should be blocked by the workaround described in
> > VU#332928. But please correct me if I'm wrong.)
>
> This is likely due to header magic detection (e.g. "%!PS-Adobe").  It
> is possible that a different path will be taken if the common
> Postscript header is not detected.  The file extension may then be
> used as a hint.  Also, there are a wide varieties of ImageMagick
> versions in use, with a wide variety of behaviors.
>
> The version of ImageMagick provided by the Ubuntu Linux I am using at
> this moment dates from 2012!
>
> Bob
> --
> Bob Friesenhahn
> bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/
> GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/