oss-sec mailing list archives
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961)
From: "Perry E. Metzger" <perry () piermont com>
Date: Tue, 9 Oct 2018 18:26:43 -0400
On Tue, 9 Oct 2018 17:14:45 -0500 (CDT) Bob Friesenhahn <bfriesen () simple dallas tx us> wrote:
On Tue, 9 Oct 2018, Tavis Ormandy wrote:I think we should encourage switching to other document formats that we have a better handle on securing. If you do need untrusted ps, I think treating it the same as shell script file you downloaded from the internet.Due to its valuable current usages (e.g. printing and format conversion) and its long legacy, Postscript is still a vital format to support in open source software. How can software consuming Postscript be aware of its origin unless it is known to be produced directly by another application? Edge applications such as web browsers may be able to help by adding warning dialogs when knowingly downloading Postscript content.
I keep wondering if there isn't a way to fully remove the dangerous bits from a postscript interpreter so it can _only_ be used to view the document and literally has no file system access compiled in at all, so there's no way to touch the fs etc. regardless of what flags the interpreter is invoked with. (I, too, find removing the ability to look at historical postscript documents a bit more draconian than I like.) Perry -- Perry E. Metzger perry () piermont com
Current thread:
- ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Tavis Ormandy (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Leonid Isaev (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Tavis Ormandy (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Bob Friesenhahn (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Perry E. Metzger (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Tavis Ormandy (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Alex Gaynor (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Doran Moppert (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Perry E. Metzger (Oct 10)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Rich Felker (Oct 16)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Perry E. Metzger (Oct 17)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Rich Felker (Oct 17)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Tavis Ormandy (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Leonid Isaev (Oct 09)