[HN Gopher] Critical RCE found in popular Ghostscript open-sourc...
       ___________________________________________________________________
        
       Critical RCE found in popular Ghostscript open-source PDF library
        
       Author : thedday
       Score  : 40 points
       Date   : 2023-07-13 21:04 UTC (1 hours ago)
        
 (HTM) web link (www.bleepingcomputer.com)
 (TXT) w3m dump (www.bleepingcomputer.com)
        
       | hulitu wrote:
       | RCE ? Since when is ghostscript a web browser ?
        
         | codetrotter wrote:
         | Doesn't have to be a web browser to be vulnerable to remote
         | code execution.
         | 
         | But it is a valid question to ask why it counts as an RCE.
         | 
         | On the one hand, they say:
         | 
         | > Successful exploitation requires user interaction by the
         | victim.
         | 
         | And on the other hand
         | 
         | > Local: No
         | 
         | > Remote: Yes
         | 
         | https://vuldb.com/?id.197290
         | 
         | The bugzilla bug tracker for Ghostscript is currently down for
         | maintenance, so can't browse it for more details at the moment.
         | 
         | But I wonder if for example a web server that uses Ghostscript
         | to convert documents could be vulnerable. In which case RCE
         | classification makes sense.
         | 
         | Otherwise, do they count it as RCE even if it involves tricking
         | a user into opening a bad file using Ghostscript? If navigating
         | to a bad website with a vulnerable browser counts as RCE in
         | other cases then perhaps opening a bad file with Ghostscript
         | counts as RCE as well?
        
           | tedunangst wrote:
           | It's remote in the sense the file comes from elsewhere. It's
           | a problem even if you trust your user (yourself), because you
           | probably open files from untrusted people.
           | 
           | Local priv escalation is something like a root exploit where
           | you don't trust the user.
        
         | ok123456 wrote:
         | Maybe if you're using it for NeWS.
        
         | lolinder wrote:
         | RCE (remote code execution) vulnerabilities aren't restricted
         | to web browsers. All it means is "an attacker can execute
         | arbitrary code on the victim's computer". In this case, many
         | people use ghostscript as a server-side component for managing
         | PDF uploads, so an attacker could theoretically upload a
         | malicious PDF and gain control over those servers.
         | 
         | Examples of non-browser RCEs:
         | 
         | * Microsoft Exchange Server and Windows:
         | https://krebsonsecurity.com/2022/01/wormable-flaw-leads-janu...
         | 
         | * Microsoft Office: https://krebsonsecurity.com/2023/07/apple-
         | microsoft-patch-tu...
         | 
         | * Apache Struts: https://krebsonsecurity.com/2018/08/experts-
         | urge-rapid-patch...
        
       | nicolas_17 wrote:
       | The article is from yesterday and at first it scared me into
       | thinking it was yet another vulnerability. Turns out it's from
       | weeks ago and Debian patched it 10 days ago. Whew.
        
       ___________________________________________________________________
       (page generated 2023-07-13 23:01 UTC)