Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 592492 - (CVE-2010-1628) CVE-2010-1628 ghostscript: internal stack overflow due to recursive calls
CVE-2010-1628 ghostscript: internal stack overflow due to recursive calls
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
http://bugs.ghostscript.com/show_bug....
impact=important,public=20100511,repo...
: Security
Depends On: 614945 614946
Blocks:
  Show dependency treegraph
 
Reported: 2010-05-14 18:51 EDT by Vincent Danen
Modified: 2015-10-15 17:12 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-02-14 08:55:58 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Ghostscript 691295 None None None Never

  None (edit)
Description Vincent Danen 2010-05-14 18:51:21 EDT
The following vulnerability was reported to Ubuntu's bug tracker [1] by Dan Rosenberg:

1. The Ghostscript interpreter fails to properly handle some cases of infinite recursion. By creating a .ps file with a sequence such as:

/A{pop 0 A 0} bind def
/product A 0

The interpreter's internal stack will be overflowed with recursive calls. Rather than gracefully handling this situation, the interpreter continues execution by jumping to an (usually invalid) address near (or past) the tail end of the stack. Without further manipulation, this would simply result in a segfault, but it turns out that by altering the number of variable definitions that occur before the call to the infinitely recursive procedure, the user can actually exert control over the address that is jumped to. Combined with the fact that the attacker has an easy way to introduce shellcode (via the .ps file), this can definitely result in arbitrary code execution. I have not developed a fully functional exploit for this case, but the attached reproducer ("infinite.ps") will trigger a segfault in the same location on all of the versions of Ghostscript I have tested, including 8.61, 8.62, 8.64, and 8.70. If you wish to more convincingly verify that this is exploitable, place varying amounts of "/A{ 0 } bind def" strings at the beginning of the file, and observe how the EIP at crash time is altered. Unfortunately, the Ghostscript code is rather complex, so I am unable to determine the root cause of this vulnerability in the source.

Reproducers are available from the noted bug report.  This was reported to Ubuntu in conjunction with the CVE-2010-1869, but it does not have a CVE name as far as I can see.

[1] https://bugs.launchpad.net/ubuntu/+source/ghostscript/+bug/546009
Comment 1 Vincent Danen 2010-05-14 18:52:54 EDT
Reported to full-disclosure here:

http://seclists.org/fulldisclosure/2010/May/134
Comment 3 Vincent Danen 2010-05-18 23:00:11 EDT
This is CVE-2010-1628.
Comment 4 Tomas Hoger 2010-05-19 10:45:57 EDT
Adding link to upstream bug as comment, URL is easy to miss:
  http://bugs.ghostscript.com/show_bug.cgi?id=691295
Comment 5 Tomas Hoger 2010-07-15 11:36:11 EDT
According to upstream bug, this issue was introduced in upstream revision r7694:

http://svn.ghostscript.com/viewvc?view=rev&revision=7694

Code changed in r7694 was first introduced in r6706:

http://svn.ghostscript.com/viewvc?view=rev&revision=6706

This change is not included in ghostscript packages in Red Hat Enterprise Linux 3, 4 and 5.

Upstream fix to correct PostScript stack overflow causing memory corruption:

http://svn.ghostscript.com/viewvc?view=rev&revision=11414

Statement:

Not vulnerable. This issue did not affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 3, 4, or 5.
Comment 7 Tomas Hoger 2010-07-15 11:40:21 EDT
Created ghostscript tracking bugs for this issue

Affects: fedora-all [bug 614946]
Comment 8 Kenichi Takemura 2010-08-03 00:26:02 EDT
Verified.
Tree:rel-eng/RHEL6.0-20100730.5

$ rpm -q ghostscript
ghostscript-8.70-6.el6.x86_64

Both of following executions do not crash ghostscript.

$ gs infinite.ps
$ gs overflow.ps

Note You need to log in before you can comment on or make changes to this bug.