Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using gs_init.ps, a different vulnerability than CVE-2010-4820.

The remote host is affected by the vulnerability described in GLSA-201412-17 (GPL Ghostscript: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GPL Ghostscript. Please       review the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted PostScript file or PDF using GPL Ghostscript, possibly resulting       in execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ghostscript by default read some initialization files from the current working directory. Local attackers could potentially exploit that to have other users execute arbitrary commands by placing such files e.g.
in /tmp (CVE-2010-2055).

An integer overflow flaw was found in Ghostscript's TrueType bytecode interpreter. An attacker could create a specially crafted PostScript or PDF file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2009-3743)

It was found that Ghostscript always tried to read Ghostscript system initialization files from the current working directory before checking other directories, even if a search path that did not contain the current working directory was specified with the '-I' option, or the '-P-' option was used (to prevent the current working directory being searched first). If a user ran Ghostscript in an attacker-controlled directory containing a system initialization file, it could cause Ghostscript to execute arbitrary PostScript code.
(CVE-2010-2055)

Ghostscript included the current working directory in its library search path by default. If a user ran Ghostscript without the '-P-' option in an attacker-controlled directory containing a specially crafted PostScript library file, it could cause Ghostscript to execute arbitrary PostScript code. With this update, Ghostscript no longer searches the current working directory for library files by default.
(CVE-2010-4820)

Note: The fix for CVE-2010-4820 could possibly break existing configurations. To use the previous, vulnerable behavior, run Ghostscript with the '-P' option (to always search the current working directory first).

A flaw was found in the way Ghostscript interpreted PostScript Type 1 and PostScript Type 2 font files. An attacker could create a specially crafted PostScript Type 1 or PostScript Type 2 font file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2010-4054)

From Red Hat Security Advisory 2012:0095 :

Updated ghostscript packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language) and an interpreter for Portable Document Format (PDF) files.

An integer overflow flaw was found in Ghostscript's TrueType bytecode interpreter. An attacker could create a specially crafted PostScript or PDF file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2009-3743)

It was found that Ghostscript always tried to read Ghostscript system initialization files from the current working directory before checking other directories, even if a search path that did not contain the current working directory was specified with the '-I' option, or the '-P-' option was used (to prevent the current working directory being searched first). If a user ran Ghostscript in an attacker-controlled directory containing a system initialization file, it could cause Ghostscript to execute arbitrary PostScript code.
(CVE-2010-2055)

Ghostscript included the current working directory in its library search path by default. If a user ran Ghostscript without the '-P-' option in an attacker-controlled directory containing a specially crafted PostScript library file, it could cause Ghostscript to execute arbitrary PostScript code. With this update, Ghostscript no longer searches the current working directory for library files by default.
(CVE-2010-4820)

Note: The fix for CVE-2010-4820 could possibly break existing configurations. To use the previous, vulnerable behavior, run Ghostscript with the '-P' option (to always search the current working directory first).

A flaw was found in the way Ghostscript interpreted PostScript Type 1 and PostScript Type 2 font files. An attacker could create a specially crafted PostScript Type 1 or PostScript Type 2 font file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2010-4054)

Users of Ghostscript are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language) and an interpreter for Portable Document Format (PDF) files.

An integer overflow flaw was found in Ghostscript's TrueType bytecode interpreter. An attacker could create a specially crafted PostScript or PDF file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2009-3743)

It was found that Ghostscript always tried to read Ghostscript system initialization files from the current working directory before checking other directories, even if a search path that did not contain the current working directory was specified with the '-I' option, or the '-P-' option was used (to prevent the current working directory being searched first). If a user ran Ghostscript in an attacker-controlled directory containing a system initialization file, it could cause Ghostscript to execute arbitrary PostScript code.
(CVE-2010-2055)

Ghostscript included the current working directory in its library search path by default. If a user ran Ghostscript without the '-P-' option in an attacker-controlled directory containing a specially crafted PostScript library file, it could cause Ghostscript to execute arbitrary PostScript code. With this update, Ghostscript no longer searches the current working directory for library files by default.
(CVE-2010-4820)

Note: The fix for CVE-2010-4820 could possibly break existing configurations. To use the previous, vulnerable behavior, run Ghostscript with the '-P' option (to always search the current working directory first).

A flaw was found in the way Ghostscript interpreted PostScript Type 1 and PostScript Type 2 font files. An attacker could create a specially crafted PostScript Type 1 or PostScript Type 2 font file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2010-4054)

Users of Ghostscript are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0095 advisory.

  - ghostscript: TrueType bytecode intepreter integer overflow or wraparound (CVE-2009-3743)

  - ghostscript: gs_init.ps searched in current directory despite -P- (CVE-2010-2055)

  - ghostscript: glyph data access improper input validation (CVE-2010-4054)

  - ghostscript: CWD included in the default library search path (CVE-2010-4820)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated ghostscript packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language) and an interpreter for Portable Document Format (PDF) files.

An integer overflow flaw was found in Ghostscript's TrueType bytecode interpreter. An attacker could create a specially crafted PostScript or PDF file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2009-3743)

It was found that Ghostscript always tried to read Ghostscript system initialization files from the current working directory before checking other directories, even if a search path that did not contain the current working directory was specified with the '-I' option, or the '-P-' option was used (to prevent the current working directory being searched first). If a user ran Ghostscript in an attacker-controlled directory containing a system initialization file, it could cause Ghostscript to execute arbitrary PostScript code.
(CVE-2010-2055)

Ghostscript included the current working directory in its library search path by default. If a user ran Ghostscript without the '-P-' option in an attacker-controlled directory containing a specially crafted PostScript library file, it could cause Ghostscript to execute arbitrary PostScript code. With this update, Ghostscript no longer searches the current working directory for library files by default.
(CVE-2010-4820)

Note: The fix for CVE-2010-4820 could possibly break existing configurations. To use the previous, vulnerable behavior, run Ghostscript with the '-P' option (to always search the current working directory first).

A flaw was found in the way Ghostscript interpreted PostScript Type 1 and PostScript Type 2 font files. An attacker could create a specially crafted PostScript Type 1 or PostScript Type 2 font file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2010-4054)

Users of Ghostscript are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

This update for ghostscript fixes the following security issues :

  - Specially crafted postscript (.ps) files can cause     buffer overflows in ghostscript that could potentially     be exploited to execute arbitrary code. (CVE-2010-1869 /     CVE-2010-1628 / CVE-2009-4270)

  - By default, ghostscript reads certain initialization     files from the current working directory. Local     attackers could potentially exploit this to have other     users execute arbitrary commands by placing such files,     e.g. in /tmp. (CVE-2010-2055)

This package fixes a security problem (CVE-2010-2055) in ghostscript whereby gs uses the current working directory to look for certain types of system file. This has been fixed by changing the default behaviour.

Additionally, several other bugs have been fixed: scripts defining GS_EXECUTABLE have been corrected; an epstopdf failure has been fixed;
some crashes that could occur in some situations have been fixed; the Fontmap.local file is once again honoured.

Further, the cups driver can now use automatic memory allocation. To enable this feature, put 'RIPCache auto' in /etc/cups/cupsd.conf.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Specially crafted postscript (.ps) files could cause buffer overflows in ghostscript that could potentially be exploited to execute arbitrary code (CVE-2010-1628, CVE-2010-1869, CVE-2009-4270)

ghostscript by default read some initialization files from the current working directory. Local attackers could potentially exploit that to have other users execute arbitrary commands by placing such files e.g.
in /tmp (CVE-2010-2055).

- Update to 3.7.1 to fix CVE-2010-2055 and CVE-2010-2056 -     Disable international support to avoid segfault on exit

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
79970	GLSA-201412-17 : GPL Ghostscript: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
75512	openSUSE Security Update : ghostscript-devel (openSUSE-SU-2010:0451-1)	Nessus	SuSE Local Security Checks	high
69649	Amazon Linux AMI : ghostscript (ALAS-2012-42)	Nessus	Amazon Linux Local Security Checks	high
68450	Oracle Linux 5 / 6 : ghostscript (ELSA-2012-0095)	Nessus	Oracle Linux Local Security Checks	high
61236	Scientific Linux Security Update : ghostscript on SL5.x, SL6.x i386/x86_64 (20120202)	Nessus	Scientific Linux Local Security Checks	high
57822	RHEL 5 / 6 : ghostscript (RHSA-2012:0095)	Nessus	Red Hat Local Security Checks	high
57809	CentOS 5 / 6 : ghostscript (CESA-2012:0095)	Nessus	CentOS Local Security Checks	high
50909	SuSE 11 / 11.1 Security Update : ghostscript (SAT Patch Numbers 2708 / 2709)	Nessus	SuSE Local Security Checks	high
49979	Fedora 12 : ghostscript-8.71-16.fc12 (2010-14633)	Nessus	Fedora Local Security Checks	high
49938	Fedora 13 : ghostscript-8.71-16.fc13 (2010-14640)	Nessus	Fedora Local Security Checks	high
49937	Fedora 14 : ghostscript-8.71-16.fc14 (2010-14549)	Nessus	Fedora Local Security Checks	high
48236	openSUSE Security Update : ghostscript-devel (openSUSE-SU-2010:0425-2)	Nessus	SuSE Local Security Checks	high
48233	openSUSE Security Update : ghostscript-devel (openSUSE-SU-2010:0425-2)	Nessus	SuSE Local Security Checks	high
47815	openSUSE Security Update : ghostscript-devel (openSUSE-SU-2010:0425-1)	Nessus	SuSE Local Security Checks	high
47686	Fedora 12 : gv-3.7.1-1.fc12 (2010-10660)	Nessus	Fedora Local Security Checks	high
47685	Fedora 13 : gv-3.7.1-1.fc13 (2010-10642)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2010-2055

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high