Insecure Privileged Calls in Ghostscript
Summary
CVE-2019-14812: A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. Affects ghostscript versions < 9.27-r3. Fixed in 9.27-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting documents. However, all versions of Ghostscript 9.x before 9.50 are vulnerable to an issue that allows scripts to bypass security restrictions and execute arbitrary commands or access the file system. This vulnerability, identified as CVE-2019-14812, can be exploited by specially crafted PostScript files.
Vulnerability Detail
The vulnerability lies in the .setuserparams2 procedure of Ghostscript, where privileged calls are not properly secured. This allows malicious scripts to disable security protection and gain unauthorized access to the file system or execute arbitrary commands. An attacker can exploit this flaw by tricking a user into opening a specially crafted PostScript file. The impact of this vulnerability is significant, as it can lead to unauthorized access, data loss, or remote code execution.
How To Fix
Minimum fixed version
9.27-r3
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can apply the following mitigation measures:
- Disable the execution of PostScript files from untrusted sources.
- Implement strict file system access controls to limit the impact of potential unauthorized access.
- Regularly monitor for any suspicious activity or unexpected file system changes.
It is important to note that these workarounds may not provide complete protection and updating to the latest version of Ghostscript is still the recommended solution.
Conclusion
Insecure privileged calls in Ghostscript versions prior to 9.50 can allow malicious scripts to bypass security restrictions and execute arbitrary commands or access the file system. It is crucial to update Ghostscript to the latest version and regularly apply security patches to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and converting documents.
This vulnerability allows malicious scripts to bypass security restrictions in Ghostscript and execute arbitrary commands or access the file system. It can lead to unauthorized access, data loss, or remote code execution.
An attacker can exploit this vulnerability by tricking a user into opening a specially crafted PostScript file that contains malicious scripts.
To fix this vulnerability, it is recommended to update Ghostscript to version 9.50 or later. Regularly updating the software is crucial to stay protected against potential vulnerabilities.
As a temporary workaround, users can disable the execution of PostScript files from untrusted sources and implement strict file system access controls. However, these workarounds may not provide complete protection.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
