CVE-2018-16802

Vulnerability

An issue was discovered in Artifex Ghostscript before version 9.25. The vulnerability involves incorrect "restoration of privilege" checking when running out of stack during exception handling [1][2]. This flaw is an incomplete fix for CVE-2018-16509, and it allows attackers who can supply crafted PostScript files to execute arbitrary code using the pipe instruction. The affected versions include Ghostscript prior to 9.25, and various distributions such as Red Hat Enterprise Linux 7 (ghostscript-9.07) and Ubuntu 18.04 LTS (ghostscript-9.22~dfsg+1-0ubuntu1.2) were impacted [1][2]. Gentoo also reported the vulnerability affecting versions before 9.26 [3].

Exploitation

To exploit this vulnerability, an attacker must be able to supply a specially crafted PostScript file to be processed by Ghostscript. This could be accomplished through various means, such as tricking a user into opening a malicious file or automated system processing untrusted documents. No authentication is required, and the attack can be launched remotely. The exploitation sequence involves the crafted PostScript triggering a stack exhaustion during exception handling, which causes the privilege restoration check to be bypassed, ultimately allowing the attacker to use the pipe instruction to execute arbitrary commands [1][2].

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the process running Ghostscript. This can lead to full compromise of the affected system, including unauthorized access to files, execution of arbitrary commands, and potential denial of service [2][3]. The impact is severe, as it can be leveraged to achieve remote code execution without requiring prior access or authentication.

Mitigation

The vulnerability is fixed in Ghostscript version 9.25 [1]. Red Hat released updated packages in RHSA-2018:3834 (ghostscript-9.07-31.el7_6.6) [1]. Ubuntu released fixed version 9.22~dfsg+1-0ubuntu1.2 for 18.04 LTS in USN-3768-1 [2]. Gentoo recommends upgrading to ghostscript-gpl-9.26 or later [3]. Users should update their Ghostscript installations to the patched versions as soon as possible. There are no known workarounds for this vulnerability [3].