Re: Re: ghostscript: 1Policy operator gives access to .forceput CVE-2018-18284

[Thomas Jarosch <thomas.jarosch () intra2net com>]

Hi,

You wrote on Thu, Oct 18, 2018 at 01:25:29PM +0000:
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Thursday, October 18, 2018 2:32 PM, Tavis Ormandy <taviso () google com> wrote:
>
> > On Thu, Oct 18, 2018 at 3:51 AM Jordan Glover <Golden_Miller83 () protonmail ch> wrote:
> >
> > > Do you know if upstream is going to make new release soon or distros should take the
> > > pain and backport all of those themselves?
> >
> > AFAIK upstream only makes quarterly releases, so I think you need to backport.
> >
> > Tavis.
>
> In normal, boring times yes but 9.25 was available just 10 days after 9.24 as urgent security
> release and it seems it was still not enough.

just a quick follow up: ghostscript 9.26 was released on 2018-11-20
and fixes the issue demonstrated by the exploit posted in:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1696

*******************************************
# gs executeonly-bypass.pdf 
GPL Ghostscript 9.26 (2018-11-20)
Copyright (C) 2018 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
what do we want?
        deprecate untrusted postscript!
when do we want it?
        now!
Error: /undefined in .policyprocs
Operand stack:
   --dict:967/1684(ro)(G)--   SAFER   false   --dict:0/0(L)--   --dict:0/0(L)--  
 --dict:967/1684(ro)(G)--   (ignored)   SAFER   false
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   
--nostringval--   2   %stopped_push   --nostringval--   --nostringval--   
--nostringval--   false   1   %stopped_push   2029   1   3   %oparray_pop   2028 
  1   3   %oparray_pop   2009   1   3   %oparray_pop   1868   1   3   
%oparray_pop   --nostringval--   %errorexec_pop   .runexec2   --nostringval--   
--nostringval--   --nostringval--   2   %stopped_push   --nostringval--   
--nostringval--
Dictionary stack:
   --dict:967/1684(ro)(G)--   --dict:0/20(G)--   --dict:79/200(L)--
Current allocation mode is local
Current file position is 575
GPL Ghostscript 9.26: Unrecoverable error, exit code 1
*******************************************

The release timeline of the vendor Artifex is also quite good:

9.24: 2018-09-03
9.25: 2018-09-13
9.26: 2018-11-20

Fedora 28 is f.e. still vulnerable though.

Best regards,
Thomas Jarosch