Ghostscript up to 9.27 .pdf_hook_DSC_Creator PostScript File access control

Summaryinfo

A vulnerability marked as critical has been reported in Ghostscript up to 9.27. Impacted is the function .pdf_hook_DSC_Creator. Performing a manipulation as part of PostScript File results in access control. This vulnerability is identified as CVE-2019-14811. The attack is only possible with local access. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Ghostscript up to 9.27 (Document Processing Software). This affects the function .pdf_hook_DSC_Creator. The manipulation as part of a PostScript File leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in, ghostscript versions prior to 9.28, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

The weakness was released 09/03/2019 as not defined bug report (Bugzilla). The advisory is shared at bugzilla.redhat.com. This vulnerability is uniquely identified as CVE-2019-14811 since 08/10/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 240001 (TencentOS Server 3: ghostscript (TSSA-2022:0123)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.28 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (240001). Entry connected to this vulnerability is available at VDB-141202. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Document Processing Software

Name

• Ghostscript

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 9.6
• 9.7
• 9.8
• 9.9
• 9.10
• 9.11
• 9.12
• 9.13
• 9.14
• 9.15
• 9.16
• 9.17
• 9.18
• 9.19
• 9.20
• 9.21
• 9.22
• 9.23
• 9.24
• 9.25
• 9.26
• 9.27

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion