Type confusion in Ghostscript - CVE-2017-8291

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU6546

Type confusion in Ghostscript - CVE-2017-8291

Published: May 15, 2017 / Updated: November 20, 2020


Vulnerability identifier: #VU6546
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-8291
CWE-ID: CWE-704
Exploitation vector: Remote access
Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on a targeted system.

The weakness exists due to type confusion error when processing user-supplied parameters passed to the .rsdparams and .eqproc functions in ghostscript. A remote attacker can submit a specially crafted .eps document, execute code in the context of the ghostscript process and bypass -dSAFER protection.

Successful exploitation of the vulnerability may result in system compromise.

Note: this vulnerability is being exploited in the wild.

Affected software

Ghostscript
Arch Linux
Amazon Linux AMI
Debian Linux
Red Hat Enterprise Linux for x86_64
SUSE Linux
Fedora
ghostscript (Alpine package)
ghostscript

How to mitigate CVE-2017-8291

Ghostscript 9.21 through 2017-04-26 is vulnerable. Older versions may also be affected.

ghostscript (Alpine package) - update to 9.21-r0
ghostscript - addressed in versions 9.20-9.fc24, 9.20-9.fc25, 9.20-10.fc26

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins