Bug 1677588 (CVE-2019-3835) - CVE-2019-3835 ghostscript: superexec operator is available (700585)
Summary: CVE-2019-3835 ghostscript: superexec operator is available (700585)
Status: CLOSED ERRATA
Alias: CVE-2019-3835
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20190321:1200...
Keywords: Security
Depends On: 1678170 1678172 1678171 1691327 1693804
Blocks: 1673302
TreeView+ depends on / blocked
 
Reported: 2019-02-15 10:06 UTC by Cedric Buissart 🐶
Modified: 2019-06-08 23:52 UTC (History)
5 users (show)

(edit) 
It was found that the superexec operator was available in the internal dictionary.  A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
Clone Of:
(edit)
Last Closed: 2019-05-07 19:21:43 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:0633 None None None 2019-03-21 16:53 UTC
Red Hat Product Errata RHSA-2019:0971 None None None 2019-05-07 04:18 UTC

Description Cedric Buissart 🐶 2019-02-15 10:06:40 UTC 
The superexec operator is available via either systemdict or internaldict, depending on ghostscript version. An attacker could use this flaw  to bypass -dSAFER restrictions and, for example, have access to the file system outside of the designated restricted directories.
Comment 1 Cedric Buissart 🐶 2019-02-15 10:07:32 UTC 
External References:

https://bugs.ghostscript.com/show_bug.cgi?id=700585
Comment 2 Cedric Buissart 🐶 2019-02-15 10:24:24 UTC 
Mitigation:

Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Comment 4 Cedric Buissart 🐶 2019-02-18 09:05:30 UTC 
Upstream fixes:
 * Fix bug 700585: Restrict superexec and remove it from internals and gs_cet.ps
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2055917

 * Bug 700585: Obliterate "superexec". We don't need it, nor do any known apps.
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d683d1e6
Comment 11 Cedric Buissart 🐶 2019-03-21 11:14:17 UTC 
Acknowledgments:

Name: Cedric Buissart (Red Hat)
Comment 12 Cedric Buissart 🐶 2019-03-21 12:12:34 UTC 
Created ghostscript tracking bugs for this issue:

Affects: fedora-all [bug 1691327]
Comment 13 errata-xmlrpc 2019-03-21 16:53:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:0633 https://access.redhat.com/errata/RHSA-2019:0633
Comment 14 errata-xmlrpc 2019-05-07 04:18:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:0971 https://access.redhat.com/errata/RHSA-2019:0971
Note You need to log in before you can comment on or make changes to this bug.