{"id":21283,"date":"2021-09-09T08:48:32","date_gmt":"2021-09-09T06:48:32","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=21283"},"modified":"2021-09-09T08:49:21","modified_gmt":"2021-09-09T06:49:21","slug":"ghostscript-0-day-schwachstelle-ermglicht-server-bernahme","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2021\/09\/09\/ghostscript-0-day-schwachstelle-ermglicht-server-bernahme\/","title":{"rendered":"GhostScript 0-day vulnerability allows server compromise"},"content":{"rendered":"

\"Sicherheit[German<\/a>]An unpatched vulnerability exists in GhostScript (up to v 9.50) that allows privilege escalation. Servers running the ImageMagick program are particularly at risk. These could be taken over by attackers. The vulnerability was discovered a year ago, but allegedly not reported to the developers. And now there is a proof-of-concept (PoC) to exploit the vulnerability via exploit. Since tools like ImageMagick use GhostScript internally and are used by many companies, admins should respond and update GhostScript<\/p>\n

<\/p>\n

What is GhostScript?<\/h2>\n

\"\"GhostScript<\/a> is a free interpreter of the PostScript page description language and the Portable Document Format (PDF). GhostScript provides a programming interface with functions to render and print PostScript and PDF content. The product runs on UNIX, Mac OS X, VMS, Windows, OS\/2 and Mac OS. <\/p>\n

GhostScript is integrated in many drivers or tools for outputting documents in PDF format. The free software package ImageMagick<\/a> for creating and editing raster and vector graphics also relies on GhostScript. GhostScript is offered by Artifex on this website<\/a>.<\/p>\n

0-day vulnerability and exploit <\/h2>\n

I already became aware of the issue<\/a> yesterday via the following tweet<\/a> from Catalin Cimpanu. The background is that a proof-of-concept for exploiting the vulnerability was published recently. <\/p>\n

\"GhostScript<\/a><\/p>\n

0-day RCE vulnerability in GhostScript 9.50<\/h3>\n

The discovery of an unpatched remote code execution (RCE) vulnerability in GhostScript 9.50 was made by Emil Lerner, founder and CTO of Wunderfund. The latter discovered the vulnerability in late 2020 and used that knowledge to collect bug bounties from companies such as Airbnb, Dropbox and Yandex. However, it appears that Lerner did not report the vulnerability to Artifex, the developer of GhostScript.<\/p>\n

\"ZeroNights<\/p>\n

In the above tweet<\/a>, Learner shares his presentation slides from his talk at ZeroNights X! There he goes into detail about a 0-day vulnerability in GhostScript 9.50, where he presented an RCE exploit chain for ImageMagick. He was able to run the exploit with the default settings from the Ubuntu repos. ImageMagick is used by several companies for image conversion on the web.<\/p>\n

New proof-of-concept<\/h3>\n

Last weekend, Vietnamese security researcher Nguyen The Duc published his proof-of-concept code (see tweet<\/a>) on GitHub<\/a>, to exploit a 0-day vulnerability in GhostScript.   <\/p>\n

\"GhostScript<\/a><\/p>\n

On GitHub, Nguyen The Duc writes that the PoC written in Python exploits a GhostScript 9.50 0-day. This 0-day exploit affects ImageMagick with the default settings from the Ubuntu repository (tested with ImageMagick's default settings on Ubuntu 20.04). Security researcher Will Dormann confirmed in a tweet<\/a>, that the PoC works.<\/p>\n

\"Will<\/a><\/p>\n

In follow-up tweets, Doormann addresses the manipulated JPG graphic files to exploit the 0-day in ImageMagick. I found Rikmer Rikmer's tweet<\/a> about workarounds to mitigate the vulnerability interesting.<\/p>\n

\"Mitigation<\/a><\/p>\n

There it refers to this nsfocusglobal.com security advisory<\/a>, which summarizes the details of the vulnerabilities a bit. According to this post, developer Artifex released \"Bug 701446: Avoid divide by zero in shading\" in Ghostscript on August 28, 2019. Artifex announced the fix for the four -dSAFER sandbox bypass vulnerabilities (-dSAFER is a security sandbox used by Ghostscript to prevent unsafe PostScript operations). <\/p>\n

Currently, the only option is to update GhostScript to newer versions. The Red Hat 7 and 8 distributions have already been updated to address these vulnerabilities. The article also describes a mitigation of the bug for systems that cannot be updated.<\/p>\n

Artifex, the company behind the Ghostscript project, told The Record that the vulnerability had not been reported to the company as part of its vulnerability disclosure process. The company says it is \"increasingly frustrated with security researchers who do not ethically disclose potentially serious vulnerabilities.\" It said it is currently working on a patch, which it hopes to release by the end of the week.<\/p>\n","protected":false},"excerpt":{"rendered":"

[German]An unpatched vulnerability exists in GhostScript (up to v 9.50) that allows privilege escalation. Servers running the ImageMagick program are particularly at risk. These could be taken over by attackers. The vulnerability was discovered a year ago, but allegedly not … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580],"tags":[69,1544],"class_list":["post-21283","post","type-post","status-publish","format-standard","hentry","category-security","tag-security","tag-software"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/21283","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=21283"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/21283\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=21283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=21283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=21283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}