Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ghostscript: /invalidaccess bypass after failed restore (699654) (CVE-2018-16509)

  - ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c     (CVE-2018-19409)

  - The getenv and filenameforall functions in Ghostscript 9.10 ignore the -dSAFER argument, which allows     remote attackers to read data via a crafted postscript file. (CVE-2013-5653)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote NewStart CGSL host, running version MAIN 4.05, has ghostscript packages installed that are affected by a vulnerability:

  - It was found that ghostscript did not properly validate     the parameters passed to the .rsdparams and .eqproc     functions. During its execution, a specially crafted     PostScript document could execute code in the context of     the ghostscript process, bypassing the -dSAFER     protection. (CVE-2017-8291)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - It was found that the fix for CVE-2018-16509 was not     complete, the missing pieces added into     ghostscript-CVE-2018-16509.patch

  - Resolves: #1641124 - CVE-2018-16509 ghostscript:
    /invalidaccess bypass after failed restore

  - Added security fix for CVE-2017-8291 (bug #1446063)

The remote host is affected by the vulnerability described in GLSA-201708-06 (GPL Ghostscript: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GPL Ghostscript. Please       review the CVE identifiers referenced below for additional information.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted PostScript file or PDF document using GPL Ghostscript possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Security fixes release for these CVEs :

  -     [CVE-2016-10217](https://access.redhat.com/security/cve/     CVE-2016-10217) *(use-after-free and application crash)*

  -     [CVE-2016-10218](https://access.redhat.com/security/cve/     CVE-2016-10218) *(NULL pointer dereference and     application crash)*

  -     [CVE-2016-10219](https://access.redhat.com/security/cve/     CVE-2016-10219) *(divide-by-zero error and application     crash)*

  -     [CVE-2016-10220](https://access.redhat.com/security/cve/     CVE-2016-10220) *(NULL pointer dereference and     application crash)*

  -     [CVE-2017-5951](https://access.redhat.com/security/cve/C     VE-2017-5951) *(NULL pointer dereference and application     crash)*

  -     [CVE-2017-7975](https://access.redhat.com/security/cve/C     VE-2017-7975) *(application crash or possible execution     of arbitrary code)*

  -     [CVE-2017-8291](https://access.redhat.com/security/cve/C     VE-2017-8291) *( -dSAFER bypass and remote command     execution)*

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for ghostscript is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code in the context of the ghostscript process, bypassing the -dSAFER protection. (CVE-2017-8291)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that ghostscript did not properly validate     the parameters passed to the .rsdparams and .eqproc     functions. During its execution, a specially crafted     PostScript document could execute code in the context     of the ghostscript process, bypassing the -dSAFER     protection. (CVE-2017-8291)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was found that ghostscript did not properly validate the parameters passed

to the .rsdparams and .eqproc functions. During its execution, a specially

crafted PostScript document could execute code in the context of the ghostscript

process, bypassing the -dSAFER protection. (CVE-2017-8291)

This update for ghostscript fixes the following security vulnerabilities :

  - CVE-2017-8291: A remote command execution and a -dSAFER     bypass via a crafted .eps document were exploited in the     wild. (bsc#1036453)

  - CVE-2016-9601: An integer overflow in the bundled     jbig2dec library could have been misused to cause a     Denial-of-Service. (bsc#1018128)

  - CVE-2016-10220: A NULL pointer dereference in the PDF     Transparency module allowed remote attackers to cause a     Denial-of-Service. (bsc#1032120)

  - CVE-2017-5951: A NULL pointer dereference allowed remote     attackers to cause a denial of service via a crafted     PostScript document. (bsc#1032114)

  - CVE-2017-7207: A NULL pointer dereference allowed remote     attackers to cause a denial of service via a crafted     PostScript document. (bsc#1030263) This is a reissue of     the previous update to also include SUSE Linux     Enterprise 12 GA LTSS packages.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Artifex Ghostscript installed on the remote Windows host is 9.21 or earlier. It is, therefore, affected by a type confusion error when handling the '.rsdparams' operator with a '/OutputFile (%pipe%' substring. An unauthenticated, remote attacker can exploit this, via a specially crafted EPS file, to bypass the
-dSAFER sandbox and execute arbitrary commands.

This update for ghostscript fixes the following security vulnerability :

  - CVE-2017-8291: A remote command execution and a -dSAFER     bypass via a crafted .eps document were exploited in the     wild. (bsc#1036453) This update is a reissue including     the SUSE Linux Enterprise 11 SP3 product.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Security fix for CVE-2017-8291 updated to address     SIGSEGV

  - Added security fix for CVE-2017-8291 (bug #1446063)

  - Fix for regression caused by previous CVE fixes (bug     #1410260)

An update for ghostscript is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code in the context of the ghostscript process, bypassing the -dSAFER protection. (CVE-2017-8291)

Security Fix(es) :

  - It was found that ghostscript did not properly validate     the parameters passed to the .rsdparams and .eqproc     functions. During its execution, a specially crafted     PostScript document could execute code in the context of     the ghostscript process, bypassing the -dSAFER     protection. (CVE-2017-8291)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1230 advisory.

    - Security fix for CVE-2017-8291 updated to address SIGSEGV

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for ghostscript fixes the following security vulnerabilities :

CVE-2017-8291: A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. (bsc#1036453)

CVE-2016-9601: An integer overflow in the bundled jbig2dec library could have been misused to cause a Denial-of-Service. (bsc#1018128)

CVE-2016-10220: A NULL pointer dereference in the PDF Transparency module allowed remote attackers to cause a Denial-of-Service.
(bsc#1032120)

CVE-2017-5951: A NULL pointer dereference allowed remote attackers to cause a denial of service via a crafted PostScript document.
(bsc#1032114)

CVE-2017-7207: A NULL pointer dereference allowed remote attackers to cause a denial of service via a crafted PostScript document.
(bsc#1030263)

This update was imported from the SUSE:SLE-12:Update update project.

A vulnerability was discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may lead to the execution of arbitrary code or denial of service if a specially crafted Postscript file is processed.

For Debian 7 'Wheezy', these problems have been fixed in version 9.05~dfsg-6.3+deb7u6.

We recommend that you upgrade your ghostscript packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ghostscript fixes the following security vulnerability :

  - CVE-2017-8291: A remote command execution and a -dSAFER     bypass via a crafted .eps document were exploited in the     wild. (bsc#1036453)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ghostscript fixes the following security vulnerabilities :

  - CVE-2017-8291: A remote command execution and a -dSAFER     bypass via a crafted .eps document were exploited in the     wild. (bsc#1036453)

  - CVE-2016-9601: An integer overflow in the bundled     jbig2dec library could have been misused to cause a     Denial-of-Service. (bsc#1018128)

  - CVE-2016-10220: A NULL pointer dereference in the PDF     Transparency module allowed remote attackers to cause a     Denial-of-Service. (bsc#1032120)

  - CVE-2017-5951: A NULL pointer dereference allowed remote     attackers to cause a denial of service via a crafted     PostScript document. (bsc#1032114)

  - CVE-2017-7207: A NULL pointer dereference allowed remote     attackers to cause a denial of service via a crafted     PostScript document. (bsc#1030263)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may lead to the execution of arbitrary code or denial of service if a specially crafted Postscript file is processed.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3272-1 advisory.

    It was discovered that Ghostscript improperly handled parameters to the rsdparams and eqproc commands. An     attacker could use these to craft a malicious document that could disable -dSAFER protections, thereby     allowing the execution of arbitrary code, or cause a denial of service (application crash).
    (CVE-2017-8291)

    Kamil Frankowicz discovered a use-after-free vulnerability in the color management module of Ghostscript.
    An attacker could use this to cause a denial of service (application crash). (CVE-2016-10217)

    Kamil Frankowicz discovered a divide-by-zero error in the scan conversion code in Ghostscript. An attacker     could use this to cause a denial of service (application crash). (CVE-2016-10219)

    Kamil Frankowicz discovered multiple NULL pointer dereference errors in Ghostscript. An attacker could use     these to cause a denial of service (application crash). (CVE-2016-10220, CVE-2017-5951, CVE-2017-7207)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198835	RHEL 5 : ghostscript (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196594	RHEL 5 : ghostscript (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
127321	NewStart CGSL MAIN 4.05 : ghostscript Vulnerability (NS-SA-2019-0097)	Nessus	NewStart CGSL Local Security Checks	high
119484	OracleVM 3.3 / 3.4 : ghostscript (OVMSA-2018-0285)	Nessus	OracleVM Local Security Checks	high
102618	GLSA-201708-06 : GPL Ghostscript: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
101695	Fedora 26 : ghostscript (2017-a606d224a5)	Nessus	Fedora Local Security Checks	high
101465	Virtuozzo 6 : ghostscript / ghostscript-devel / ghostscript-doc / etc (VZLSA-2017-1230)	Nessus	Virtuozzo Local Security Checks	high
100694	EulerOS 2.0 SP2 : ghostscript (EulerOS-SA-2017-1101)	Nessus	Huawei Local Security Checks	high
100693	EulerOS 2.0 SP1 : ghostscript (EulerOS-SA-2017-1100)	Nessus	Huawei Local Security Checks	high
100638	Amazon Linux AMI : ghostscript (ALAS-2017-837)	Nessus	Amazon Linux Local Security Checks	high
100410	SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2017:1404-1)	Nessus	SuSE Local Security Checks	high
100356	Artifex Ghostscript .rsdparams Operator Handling Type Confusion RCE	Nessus	Windows	high
100264	SUSE SLES11 Security Update : ghostscript-library (SUSE-SU-2017:1322-1)	Nessus	SuSE Local Security Checks	high
100205	OracleVM 3.3 / 3.4 : ghostscript (OVMSA-2017-0103)	Nessus	OracleVM Local Security Checks	high
100201	Fedora 24 : ghostscript (2017-fae1506f94)	Nessus	Fedora Local Security Checks	high
100175	CentOS 6 / 7 : ghostscript (CESA-2017:1230)	Nessus	CentOS Local Security Checks	high
100173	Scientific Linux Security Update : ghostscript on SL6.x, SL7.x i386/x86_64 (20170512)	Nessus	Scientific Linux Local Security Checks	high
100172	RHEL 6 / 7 : ghostscript (RHSA-2017:1230)	Nessus	Red Hat Local Security Checks	high
100171	Oracle Linux 6 / 7 : ghostscript (ELSA-2017-1230)	Nessus	Oracle Linux Local Security Checks	high
100041	openSUSE Security Update : ghostscript (openSUSE-2017-558)	Nessus	SuSE Local Security Checks	high
99998	Debian DLA-932-1 : ghostscript security update	Nessus	Debian Local Security Checks	high
100013	Fedora 25 : ghostscript (2017-c85c0e5637)	Nessus	Fedora Local Security Checks	high
99979	SUSE SLES11 Security Update : ghostscript-library (SUSE-SU-2017:1153-1)	Nessus	SuSE Local Security Checks	high
99761	SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2017:1138-1)	Nessus	SuSE Local Security Checks	high
99741	Debian DSA-3838-1 : ghostscript - security update	Nessus	Debian Local Security Checks	high
99726	Ubuntu 14.04 LTS / 16.04 LTS : Ghostscript vulnerabilities (USN-3272-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2017-8291

high

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high