On Mon, 10 Dec 2001, Patrick Powell wrote:
> > From [EMAIL PROTECTED] Thu Dec 6 14:34:50 2001
> > Date: Thu, 6 Dec 2001 13:12:59 -0800 (PST)
> > From: Carl Riches <[EMAIL PROTECTED]>
> > To: LPRng List <[EMAIL PROTECTED]>
> > cc: Carl Riches <[EMAIL PROTECTED]>
> > Subject: LPRng: ghostscript mods to -dSAFER
> >
<< stuff deleted >>
> >
> > % this section modified to fix a security problem
> > /file
> > { //SAFETY /safe get {
> > dup (r) eq
> > 2 index (%pipe*) .stringmatch not and
> > 3 index (%std*) .stringmatch not and
> > or or
> > { file }
> > { /invalidfileaccess //signalerror exec }
> > ifelse
> > } {
> > file
> > } ifelse
> > } .bind executeonly odef
> >
<< stuff deleted >>
> Could you add some comments about this? Or as they say in
> Postscript:
>
> ?od ti seod tahw
>
!!em staeB
I think it fixes the -dSAFER security hole you note in your ifhp docs.
But here is what I put into my AFPL Ghostscript 7.03 installation log
(sorry for the length, it quotes some e-mail traffic from this list...):
##############################################################################
7) Before installing the software, I needed to fix a security problem noted by
the ifhp software. The problem lies in the way the "-dSAFER" switch works.
There is a note in the ifhp source tree that says:
Summary: Printing a file can cause a system compromise
Reason: GhostScript can open and read files on system
(-dSAFER may not disable file open)
Systems Impacted: just about everything that uses GhostScript (or
some other PostScript interpreters) for PostScript document
conversion. This includes the various MagicFilters, Transcript,
LPRng's ifhp, RedHats rh-printfilter. These are running on Linux,
BSD, System V, possibly Sun Microsystems, HP, etc., etc., etc.
Note: it is possible that the same problem exists on Microsoft
systems as well if they are performing PostScript to conversions.
Detailed Explanation:
GhostScript is used to convert PostScript files to formats compatible
with printers and other devices. It is used as a utility by a
large number of 'print filters', including MagicFilters, format
converters, LPRng's IFHP filter, RedHat's rh-printfilter, Transcript,
etc., etc.
The PostScript 'file' operator opens a file which can then be
read and printed. Here is a sample of how this could be done:
Save these lines to 'testpr':
%!
% Code extracts from PostScript Language Tutorial and Cookbook
% Copyright 1986, Adobe Systems.
% set up printing
/finr /Helvetica findfont 10 scalefont def
/shwr {moveto finr setfont show} def
% do the dirty work here
(/etc/passwd) (r) file
% read a single line
100 string readline pop 45 292 shwr showpage
Now run this using GhostScript:
#> gs testpr
If you see the first line of the /etc/passwd file displayed then
you have a possible compromise. If GhostScript is used to convert
PostScript to PCL or some other non-PostScript format then you can
print copies of the various files of interest.
Now try this with -dSAFER
#> gs -dSAFER testpr
If you see the same output, then the -dSAFER is not preventing
file access.
MORE BAD NEWS:
Now, you might think this is the worst that can happen...
Nope. I just discovered the following:
a) GhostScript can open files for writing as well as reading.
b) Some vendors run their print filters as ROOT.
c) Some do not have -dSAFER enabled.
You might want to think about:
(/etc/shadow) (w) file (root:::::) writeline
There... did your blood run cold? Or are you rushing out to
try this on your local system to see if the Sysadmin has fixed
this? (Note for sysadmin: there is no 'writeline' primitive,
but they will whip one up REAL SOON NOW, so get moving.)
AND A POSSIBLE ADDITIONAL EXPLOIT:
In addition to the 'file' command, there is also the 'run' command
that will open a file and execute its contents. I can't think of
any use for this, but better to be safe than sorry. Since most
students^H^H^H^H^H^H users are smarter than me, they will most
likely think of one.
IMMEDIATE STEPS TO TAKE:
Step 1: TURN OFF PRINTING NOW! Kill the LPD print spooler
server or the lpsched print spooling server:
pkill lpd
OR
killall lpd
OR
ps -e |grep lpd; find the PID of the lpd process
and do: kill PID
ps -e |grep lpsched; find the PID of the lpsched process
and do: kill PID
Step 2: Update to the latest version of GhostScript that has
-dSAFER implemented.
Step 3: Modify the gs_init.ps file. It is usually in:
/usr/share/ghostscript/XXX/lib/gs_init.ps
where XXX is the version of GhostScript.
The following changes will disable 'file' and 'run' when
when gs is executed with -dSAFER.
1. open the gs_init.ps file.
2. Look for the following lines and add the lines
with - in front of them.
% If we want a "safer" system, disable some obvious ways to cause havoc.
SAFER not { (%END SAFER) .skipeof } if
/file
{ dup (r) eq 2 index (%pipe*) .stringmatch not and
2 index (%std*) .stringmatch or
{ file }
{ /invalidfileaccess signalerror }
ifelse
} .bind odef
- /file { /invalidfileaccess signalerror } odef
- /run { /invalidfileaccess signalerror } odef
/renamefile { /invalidfileaccess signalerror } odef
/deletefile { /invalidfileaccess signalerror } odef
/putdeviceprops
Step 4: make sure that all the conversion scripts use gs -dSAFER
Step 5: (for the VERY VERY paranoid sysamin)
Comment out the 'SAFER not ...' line; this will
ALWAYS run GhostScript in SAFER mode.
Step 6:
save the modified gs_init.ps file.
Step 5:
Try executing the 'testpr' file again. It should fail.
Step 6:
Renable printing and try printing the 'testpr' file
to a printer that requires raster conversion.
Your job should fail with a GhostScript error.
Patrick Powell Astart Technologies,
[EMAIL PROTECTED] 9475 Chesapeake Drive, Suite D,
Network and System San Diego, CA 92123
Consulting 858-874-6543 FAX 858-279-8424
LPRng - Print Spooler (http://www.lprng.com)
The fix noted above doesn't work. I located the following note in the archives
of the LPRng mailing list. (The archives are located at:
http://www.findmail.com/list/lprng
Here is the message:
From: Dirk Krause <[EMAIL PROTECTED]>
Date: Wed Sep 19, 2001 4:24 pm
Subject: Re: LPRng: SECURITY BULLETIN - GhostScript -dSAFER ...
Hi Patrick,
At 08:06 18.09.01 -0700, you wrote:
>...
>1. open the gs_init.ps file.
>2. Look for the following lines and add the lines
> with - in front of them.
>
> % If we want a "safer" system, disable some obvious ways to cause havoc.
> SAFER not { (%END SAFER) .skipeof } if
> /file
> { dup (r) eq 2 index (%pipe*) .stringmatch not and
> 2 index (%std*) .stringmatch or
> { file }
> { /invalidfileaccess signalerror }
> ifelse
> } .bind odef
>- /file { /invalidfileaccess signalerror } odef
>- /run { /invalidfileaccess signalerror } odef
> /renamefile { /invalidfileaccess signalerror } odef
The PS run command does not run a command on the system level.
It opens a PS file and executes the Postscript instructions contained in
the file.
What's the reason to deny this command in safer mode?
In the gs_init.ps file shipped with ghostscript
/file
...
} .bind odef
seems not to combine the conditions correctly.
I'm not an expert for ghostscripts internals, but I assume
%pipe* to be a pattern matching names for pipes internally opened by ghostscript
itself and %std* a pattern for standard input, output and diagnostics output.
To have a "safer" system I would grant read access to every file the user
has read-permissions to and write access to the pipes and the standard streams.
The new definition in my modified gs_init.ps (derived from that shipped with
AFPL ghostscript 7.00) looks like this:
/file
{ //SAFETY /safe get {
dup (r) eq
2 index (%pipe*) .stringmatch
3 index (%std*) .stringmatch
or or
{ file }
{ /invalidfileaccess //signalerror exec }
ifelse
} {
file
} ifelse
} .bind executeonly odef
For earlier GS versions it could be:
/file
{
dup (r) eq
2 index (%pipe*) .stringmatch
3 index (%std*) .stringmatch
or or
{ file }
{ /invalidfileaccess signalerror }
ifelse
} .bind odef
I also did not find documentation about .stringmatch but assume
it to do pattern matching.
If one does not trust this function remove the
2 index (%pipe*) .stringmatch
3 index (%std*) .stringmatch
or or
lines.
If ghostscript is run as root and processes input from other users
(i.e. because a print system is running under root-account) I would
completely disable the file operator as the security bulletin recommends.
Greetings
Dirk
-----------------------------------------------------------
[EMAIL PROTECTED]
http://www.e-technik.fh-schmalkalden.de/personen/dhp/krause
-----------------------------------------------------------------------------
YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRNG MAILING LIST
If you need help, send email to [EMAIL PROTECTED] (or lprng-requests
or lprng-digest-requests) with the word 'help' in the body. For the impatient,
to subscribe to a list with name LIST, send mail to [EMAIL PROTECTED]
with: | example:
subscribe LIST <mailaddr> | subscribe lprng-digest [EMAIL PROTECTED]
unsubscribe LIST <mailaddr> | unsubscribe lprng [EMAIL PROTECTED]
If you have major problems, send email to [EMAIL PROTECTED] with the word
LPRNGLIST in the SUBJECT line.
-----------------------------------------------------------------------------
The modifications noted in this message did not work, either. However, I made
a couple of minor modifications to the change which did the trick. Here are
the final diffs between the original and the final versions of the file:
lib/gs_init.ps
as found in the gs7.03 source tree:
------- gs_init.ps -------
1567,1568c1567,1570
< dup (r) eq 2 index (%pipe*) .stringmatch not and
< 2 index (%std*) .stringmatch or
---
> dup (r) eq
> 2 index (%pipe*) .stringmatch not and
> 3 index (%std*) .stringmatch not and
> or or
#############################################################################
The two modifications that failed to work (above) would absolutely break
AFPL Ghostscript 7.03, that is, it would not process _any_ PostScript
file. I am not a PostScript programmer. I arrived at my changes by
examining the original postscript code contained in gs_init.ps and both of
the changes that failed. My changes pass the Ghostscript security hole
test you have placed into ifhp 3.4.7's configure script, and the changes
still successfully process various PostScript files I have laying about.
I just don't know if this code is correct and bug-free.
Carl
Carl G. Riches
Software Engineer
Department of Mathematics
Box 354350 voice: 206-543-5082 or 206-616-3636
University of Washington fax: 206-543-0397
Seattle, WA 98195-4350 internet: [EMAIL PROTECTED]
-----------------------------------------------------------------------------
YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRNG MAILING LIST
The address you post from MUST be your subscription address
If you need help, send email to [EMAIL PROTECTED] (or lprng-requests
or lprng-digest-requests) with the word 'help' in the body. For the impatient,
to subscribe to a list with name LIST, send mail to [EMAIL PROTECTED]
with: | example:
subscribe LIST <mailaddr> | subscribe lprng-digest [EMAIL PROTECTED]
unsubscribe LIST <mailaddr> | unsubscribe lprng [EMAIL PROTECTED]
If you have major problems, send email to [EMAIL PROTECTED] with the word
LPRNGLIST in the SUBJECT line.
-----------------------------------------------------------------------------
