oss-sec mailing list archives
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?
From: Stuart Gathman <stuart () gathman org>
Date: Wed, 5 Sep 2018 15:13:53 -0400
On 09/05/2018 03:01 PM, Perry E. Metzger wrote:
On Wed, 5 Sep 2018 11:02:48 -0700 Tavis Ormandy <taviso () google com> wrote:I would like to re-emphasize that while Ghostscript is very capable and mature software, I consider the -dSAFER sandbox to be a fragile security boundary and that we should consider deprecating (or minimizing the use of) untrusted postscript.I haven't been following the bugs in depth (just noticing the continuous stream of them arriving), but is the issue security flaws in just -dSAFER or is it overall security bugs? If it's the former, given how few things actually need any of the features past what -dSAFER offers, perhaps compiling the code by default without any such capabilities would work well? You can't run what isn't there.
Postscript is a general purpose programming language. It can do anything to your system that a C or Python program could. The SAFER sandbox was supposed to be able to prevent untrusted postscript code from doing serious damage. But this series of bugs shows that the sandbox is very flawed, and running untrusted postscript relying only on the SAFER sandbox is a very bad idea. What I need to study, is whether random PDF files from the internet (as opposed to general postscript) are therefore malware vectors. I thought that PDF used a restricted subset of operations that "rendered" it not a general purpose language and therefore "safe". But if SAFER was the implementation of that restricted subset, then all internet PDFs are suspect.
Current thread:
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?, (continued)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Marcus Meissner (Aug 28)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Aug 29)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Aug 29)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Marcus Meissner (Sep 03)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Sep 04)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Sep 04)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Brandon Perry (Sep 04)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Sep 04)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Sep 05)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Perry E. Metzger (Sep 05)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Stuart Gathman (Sep 05)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Perry E. Metzger (Sep 05)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Leonid Isaev (Sep 06)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Jakub Wilk (Sep 06)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Leonid Isaev (Sep 06)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Sep 09)
- Message not available
- Re: Ghostscript 9.24 issues Tavis Ormandy (Sep 09)
- Re: Re: Ghostscript 9.24 issues Marcus Meissner (Sep 10)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Marcus Meissner (Sep 06)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Aug 22)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Aug 22)