Bugtraq mailing list archives
Re: Ghostscript 8.64 executes random code at startup
From: paul.szabo () sydney edu au
Date: Wed, 26 May 2010 12:32:51 +1000
Dear Christopher,
Ghostscript_8.64 on openSuSE_11.2 executes all files matching ./Encoding/* on startup. This search is relative to the current directory so it is easy to poison Ghostscript and cause it to execute arbitrary PostScript code without user action or knowledge. Details: <URL:https://bugzilla.novell.com/show_bug.cgi?id=608071>
Interesting! So if someone creates /tmp/Encoding then it is dangerous to do cd /tmp; gs any.ps I now used: strace -omylog gs grep '"\./' mylog | sort -u and that shows that gs tries many files in currrent directory, "protection" against just ./Encoding is not enough. Cheers, Paul Szabo psz () maths usyd edu au http://www.maths.usyd.edu.au/u/psz/ School of Mathematics and Statistics University of Sydney Australia
Current thread:
- Ghostscript 8.64 executes random code at startup ne01026 (May 25)
- Re: Ghostscript 8.64 executes random code at startup paul . szabo (May 26)
- Re: Ghostscript 8.64 executes random code at startup Krzysztof Żelechowski (May 26)
- Re: Ghostscript 8.64 executes random code at startup paul . szabo (May 26)
- Re: Ghostscript 8.64 executes random code at startup Krzysztof Żelechowski (May 26)
- <Possible follow-ups>
- Re: Ghostscript 8.64 executes random code at startup paul . szabo (May 27)
- Re: Ghostscript 8.64 executes random code at startup paul . szabo (May 28)
- Re: Ghostscript 8.64 executes random code at startup paul . szabo (May 31)
- Re: Ghostscript 8.64 executes random code at startup paul . szabo (May 26)