CVE-2017-8291 - Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdpa

CVE-2017-8291

Summary

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

References

Vulnerable Configurations

cpe:2.3:a:artifex:ghostscript:-:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:-:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:8_64:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:8_64:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.00:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.00:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.01:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.01:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.02:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.02:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.04:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.04:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.05:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.05:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.06:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.06:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.07:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.07:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.09:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.09:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.10:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.10:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.14:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.14:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.15:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.15:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.16:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.16:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.18:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.18:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.19:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.19:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.20:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.20:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.21:*:*:*:*:*:*:*
cpe:2.3:a:artifex:ghostscript:9.21:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 05-01-2018 - 02:31)
Impact:
Exploitability:

CWE

CWE-704

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

redhat via4

advisories

bugzilla

id	1446063
title	CVE-2017-8291 ghostscript: corruption of operand stack

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 7 is installed
oval oval:com.redhat.rhba:tst:20150364027

AND
comment ghostscript is earlier than 0:9.07-20.el7_3.5
oval oval:com.redhat.rhsa:tst:20171230001
comment ghostscript is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20120095009

AND

comment ghostscript-cups is earlier than 0:9.07-20.el7_3.5
oval oval:com.redhat.rhsa:tst:20171230003
comment ghostscript-cups is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20170013004

AND

comment ghostscript-devel is earlier than 0:9.07-20.el7_3.5
oval oval:com.redhat.rhsa:tst:20171230005
comment ghostscript-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20120095011

AND

comment ghostscript-doc is earlier than 0:9.07-20.el7_3.5
oval oval:com.redhat.rhsa:tst:20171230007
comment ghostscript-doc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20120095013

AND

comment ghostscript-gtk is earlier than 0:9.07-20.el7_3.5
oval oval:com.redhat.rhsa:tst:20171230009
comment ghostscript-gtk is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20120095015

AND

comment Red Hat Enterprise Linux 6 is installed
oval oval:com.redhat.rhba:tst:20111656003

AND
comment ghostscript is earlier than 0:8.70-23.el6_9.2
oval oval:com.redhat.rhsa:tst:20171230012
comment ghostscript is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20120095009

AND

comment ghostscript-devel is earlier than 0:8.70-23.el6_9.2
oval oval:com.redhat.rhsa:tst:20171230013
comment ghostscript-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20120095011

AND

comment ghostscript-doc is earlier than 0:8.70-23.el6_9.2
oval oval:com.redhat.rhsa:tst:20171230014
comment ghostscript-doc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20120095013

AND

comment ghostscript-gtk is earlier than 0:8.70-23.el6_9.2
oval oval:com.redhat.rhsa:tst:20171230015
comment ghostscript-gtk is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20120095015

rhsa

id	RHSA-2017:1230
released	2017-05-12
severity	Important
title	RHSA-2017:1230: ghostscript security update (Important)

rpms

ghostscript-0:8.70-23.el6_9.2
ghostscript-0:9.07-20.el7_3.5
ghostscript-cups-0:9.07-20.el7_3.5
ghostscript-debuginfo-0:8.70-23.el6_9.2
ghostscript-debuginfo-0:9.07-20.el7_3.5
ghostscript-devel-0:8.70-23.el6_9.2
ghostscript-devel-0:9.07-20.el7_3.5
ghostscript-doc-0:8.70-23.el6_9.2
ghostscript-doc-0:9.07-20.el7_3.5
ghostscript-gtk-0:8.70-23.el6_9.2
ghostscript-gtk-0:9.07-20.el7_3.5

refmap via4

bid	98476
confirm	https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=04b37bbce174eed24edec7ad5b920eb93db4d47d
debian	DSA-3838
exploit-db	41955
gentoo	GLSA-201708-06
misc	http://openwall.com/lists/oss-security/2017/04/28/2 https://bugs.ghostscript.com/show_bug.cgi?id=697808 https://bugzilla.redhat.com/show_bug.cgi?id=1446063 https://bugzilla.suse.com/show_bug.cgi?id=1036453

Last major update

05-01-2018 - 02:31

Published

27-04-2017 - 01:59

Last modified

05-01-2018 - 02:31