Critical Remote Command Execution Vulnerability in Ghostscript
Summary
ALPINE-CVE-2017-8291: Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program... Affects ghostscript versions < 9.21-r2. Fixed in 9.21-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is known for its versatility and is often integrated into applications that require document manipulation. However, Ghostscript has been found to have a significant vulnerability that can lead to remote command execution, posing a serious security risk to systems utilizing this software.
Vulnerability Detail
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a '/OutputFile (%pipe%' substring in a crafted .eps document that is an input to the gs program. This vulnerability can be exploited by attackers to execute arbitrary commands on the host system, potentially leading to unauthorized access and data breaches. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
9.21-r2
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the processing of .eps files or restrict the use of the -dSAFER option until the package is updated. However, this may limit the functionality of applications relying on Ghostscript.
Conclusion
The vulnerability in Ghostscript poses a significant risk of remote command execution, which can have severe implications for affected systems. It is crucial to update to the patched version to mitigate this risk. Users should also consider temporary workarounds until the update can be applied.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability allows for remote command execution due to a type confusion issue with specific parameters in crafted .eps documents.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized command execution, data breaches, and compromise of the host system.
Yes, you can disable the processing of .eps files or restrict the use of the -dSAFER option as a temporary workaround.
The CVSS score of this vulnerability is 7.8, indicating a high level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
