A flaw was found in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
DescriptionCedric Buissart
2019-08-21 08:03:34 UTC
There seem to be several .forceput accessible in .pdfexectoken and other procedures.
For the case of .pdfexectoken : several .forceput are available on the stack :
{-dict- /PDFSTEPcount --known-- --not-- {-dict- /PDFSTEPcount 1 --.forceput--} --executeonly-- --if-- PDFSTEP {-dict- /PDFtokencount 2 --copy-- --.knownget-- {1 --add--} {1} --ifelse-- --.forceput-- PDFSTEPcount 1 --gt-- {-dict- /PDFSTEPcount PDFSTEPcount 1 --sub-- --.forceput--} --executeonly-- {--dup-- ==only ( step # ) --print-- PDFtokencount =only ( ? ) --print-- --flush-- 1 false --.outputpage-- (%stdin) (r) --file-- 255 --string-- --readline-- {--token-- {--exch-- --pop-- -dict- /PDFSTEPcount 3 -1 --roll-- --.forceput--} --executeonly-- {-dict- /PDFSTEPcount 1 --.forceput--} --executeonly-- --ifelse--} {--pop-- /PDFSTEP false --def--} --ifelse--} --ifelse--} --executeonly-- {--dup-- ==only () = --flush--} --ifelse--}
As with the other recent vulnerabilities the recent mitigation included post- gs-9.27 successfully prevents arbitrary file access & code execution even when the script disables SAFER. However gs up to version 9.27 are affected.
This can be used to disable -dSAFER and, for example, access files outside of the restricted area, or command execution.
Reference:
https://bugs.ghostscript.com/show_bug.cgi?id=701450
There seem to be several .forceput accessible in .pdfexectoken and other procedures. For the case of .pdfexectoken : several .forceput are available on the stack : {-dict- /PDFSTEPcount --known-- --not-- {-dict- /PDFSTEPcount 1 --.forceput--} --executeonly-- --if-- PDFSTEP {-dict- /PDFtokencount 2 --copy-- --.knownget-- {1 --add--} {1} --ifelse-- --.forceput-- PDFSTEPcount 1 --gt-- {-dict- /PDFSTEPcount PDFSTEPcount 1 --sub-- --.forceput--} --executeonly-- {--dup-- ==only ( step # ) --print-- PDFtokencount =only ( ? ) --print-- --flush-- 1 false --.outputpage-- (%stdin) (r) --file-- 255 --string-- --readline-- {--token-- {--exch-- --pop-- -dict- /PDFSTEPcount 3 -1 --roll-- --.forceput--} --executeonly-- {-dict- /PDFSTEPcount 1 --.forceput--} --executeonly-- --ifelse--} {--pop-- /PDFSTEP false --def--} --ifelse--} --ifelse--} --executeonly-- {--dup-- ==only () = --flush--} --ifelse--} As with the other recent vulnerabilities the recent mitigation included post- gs-9.27 successfully prevents arbitrary file access & code execution even when the script disables SAFER. However gs up to version 9.27 are affected. This can be used to disable -dSAFER and, for example, access files outside of the restricted area, or command execution. Reference: https://bugs.ghostscript.com/show_bug.cgi?id=701450