Remote Code Execution in Artifex Ghostscript through 10.01.2
Summary
CVE-2023-43115: In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER h... Affects ghostscript versions < 10.02.0-r0. Fixed in 10.02.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and processing documents. The vulnerability affects GhostPDL, a component of Ghostscript. GhostPDL allows users to convert PostScript files to other formats. The vulnerability in gdevijs.c can be exploited through crafted PostScript documents, enabling remote code execution. This occurs when the IJS device is switched to or the IjsServer parameter is modified after SAFER (a security mechanism) has been activated. It is important to note that the IJS server can be specified on a gs command line, which triggers the execution of a command to start the IJS server.
Vulnerability Detail
The vulnerability (CVE-2023-43115) in Artifex Ghostscript allows an attacker to execute arbitrary code remotely. By leveraging a crafted PostScript document, an attacker can manipulate the IJS device or modify the IjsServer parameter after SAFER has been activated. This can lead to the execution of malicious commands and potentially compromise the system. The IJS server, which is responsible for executing the IJS device, poses a documented risk as it requires a command to start the server.
How To Fix
Minimum fixed version
10.02.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid using the IJS device or modify the IjsServer parameter. By preventing the use of the IJS device or carefully configuring the IjsServer parameter, the risk of remote code execution can be reduced. However, this workaround may impact the functionality of certain features or workflows that rely on the IJS device.
Conclusion
The vulnerability in Artifex Ghostscript allows for remote code execution through crafted PostScript documents. It is crucial to update to the latest version of Ghostscript (10.02.0-r0 or later) to mitigate this vulnerability. Users can also consider workarounds such as avoiding the use of the IJS device or modifying the IjsServer parameter. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Artifex Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and processing documents.
The vulnerability in GhostPDL allows an attacker to execute arbitrary code remotely by manipulating the IJS device or modifying the IjsServer parameter after SAFER has been activated. This can lead to the execution of malicious commands and potential compromise of the system.
The IJS server, which is responsible for executing the IJS device, poses a documented risk as it requires a command to start the server. This can be exploited by an attacker to execute arbitrary commands.
To mitigate this vulnerability, it is recommended to update Ghostscript to version 10.02.0-r0 or later. Regularly updating the software ensures that you receive the latest security fixes and patches.
As a workaround, users can avoid using the IJS device or modify the IjsServer parameter. However, this may impact the functionality of certain features or workflows that rely on the IJS device.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
