Re: Security risks when invoking ghostscript

Aidan Van Dyk wrote:
> * Giuseppe Sacco <[email protected]> [100602 16:49]:
>   
>> Hi all,
>> it seems ghostscript look for all files in current directory before
>> searching in its preferred path. This is its default behaviour. The way
>> to disable it, is to use option "-P-"[1]. There a few bug reports
>> signalling this problem, as for [2] (the latest one) and [3] (the first
>> one).
>>
>> What is your opinion about this problem when gs is invoked by hylafax?
>> Is there any real risks?
>>     
>
> I haven't done a *thourough* investigation, but AFAIK, the "files" it
> reads from . are a fixed set (like gsinit, etc), and not something the
> user can "name" like (tmp/bla).
>
> If that stands true, then HylaFAX doesn't need to consert itself,
> because only the admin can place files directly in /var/spool/hylafax
> (and that's where  HF always runs GS from).
>
> If the files GS tries to load are dependant on user content (i.e could
> be make to try and load tmp/bla) then it could affect HylaFAX.
>
> But either way, the -P- option sounds preferable... I've given it a
> quick spin on a test, but if others want to test it out on a wide range
> of GS versions, I'ld think it's a good change to make.

The -P- option doesn't work on Ghostscript 6.51 and causes gs to fail to 
produce a TIFF file.  That's the oldest working copy I have going in 
production.

I have a difficult time seeing how a malicious user could exploit this 
risk via HylaFAX.

Thanks,

Lee.




____________________ HylaFAX(tm) Developers Mailing List ____________________
  To subscribe/unsubscribe, click http://lists.hylafax.org/cgi-bin/lsg2.cgi
On UNIX: mail -s unsubscribe [email protected] < /dev/null