OS command injection in Ghostscript - CVE-2018-16509

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU14690

OS command injection in Ghostscript - CVE-2018-16509

Published: September 7, 2018 / Updated: June 9, 2021


Vulnerability identifier: #VU14690
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-16509
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to /invalidaccess checks can be bypassed after a restore failure. A remote unauthenticated attacker can trick the victim into opening a specially crafted PostScript file that submits malicious input and execute arbitrary shell commands.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: original fix for this vulnerability was incomplete in version 9.24. Vendor has issued another patch.


Affected software

Ghostscript
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Slackware Linux
ghostscript (Debian package)
Data Computing Appliance (DCA)

How to mitigate CVE-2018-16509

Update to version 9.25.

Ghostscript - update to 9.24
ghostscript (Debian package) - update to 9.20~dfsg-3.2+deb9u5
Data Computing Appliance (DCA) - update to 3.5.3.0

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins