{"id":101245,"date":"2021-09-10T22:22:37","date_gmt":"2021-09-10T20:22:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick"},"modified":"2021-09-10T22:22:37","modified_gmt":"2021-09-10T20:22:37","slug":"uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick","title":{"rendered":"Vainojam\u012bba Ghostscript, ko izmanto caur ImageMagick","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ghostscript ir r\u012bku komplekts dokumentu apstr\u0101dei, konvert\u0113\u0161anai un \u0123ener\u0113\u0161anai PostScript un PDF form\u0101tos, kur\u0101 atkl\u0101ta kritiska ievainojam\u012bba (CVE-2021-3781), kas \u013cauj izpild\u012bt patva\u013c\u012bgu kodu, apstr\u0101d\u0101jot speci\u0101li sagatavotu failu. Problemu s\u0101kotn\u0113ji nor\u0101d\u012bja Em\u012bls Lerneris, kur\u0161 par ievainojam\u012bbu run\u0101ja 25. august\u0101 notiku\u0161aj\u0101 konference ZeroNights X Sanktp\u0113terburg\u0101 (zi\u0146ojum\u0101 tika min\u0113ts, k\u0101 Em\u012bls bug bounty programmas ietvaros izmantoja \u0161o ievainojam\u012bbu, lai ieg\u016btu pr\u0113mijas par uzbrukumu demonstr\u0113\u0161anu AirBNB, Dropbox un Yandex.Nekustamais \u012bpa\u0161ums pakalpojumiem). <\/p>\n

5. septembr\u012b publiski k\u013cuva pieejams funkcion\u0101ls eksploit\u0101cija, kas \u013cauj uzbrukumiem sist\u0113m\u0101m ar Ubuntu 20.04, nos\u016btot server\u012b izpild\u0101mam web-skriptam, kuram tiek izmantots php-imagemagick pakotne, speci\u0101li sagatavotu dokumentu, kas tika iel\u0101d\u0113ts k\u0101 bilde. Iepriek\u0161\u0113jie dati liek dom\u0101t, ka \u0161\u0101da eksploit\u0101cija tika lietota jau kop\u0161 marta. Tika apgalvots, ka uzbrukumi iesp\u0113jami pret sist\u0113m\u0101m, kur\u0101s darbojas GhostScript 9.50, ta\u010du noskaidroj\u0101s, ka ievainojam\u012bba par\u0101d\u0101s ar\u012b vis\u0101s n\u0101kamaj\u0101s GhostScript versij\u0101s, ieskaitot att\u012bst\u012bbas izlaidumu 9.55 no Git. <\/p>\n

Labojums tika pied\u0101v\u0101ts 8. septembr\u012b un p\u0113c p\u0101rskata tika pie\u0146emts GhostScript kr\u0101tuv\u0113 9. septembr\u012b. Daudzos izplat\u012bjumos probl\u0113ma v\u0113l joproj\u0101m nav nov\u0113rsta (atjaunin\u0101jumu publik\u0101cijas statusu var apskat\u012bt Debian, Ubuntu, Fedora, SUSE, RHEL, Arch Linux, FreeBSD un NetBSD lap\u0101s). GhostScript laidienu ar ievainojam\u012bbas nov\u0113r\u0161anu pl\u0101no izlaist l\u012bdz m\u0113ne\u0161a beig\u0101m. <\/p>\n

Probl\u0113ma ir saist\u012bta ar iesp\u0113ju apiet izol\u0101cijas re\u017e\u012bmu «-dSAFER» nepietiekamas p\u0101rbaudes d\u0113\u013c Postscript ier\u012bces «%pipe%», kas \u013c\u0101va izpild\u012bt patva\u013c\u012bgas shell komandas. Piem\u0113ram, lai palaistu util\u012btu id dokument\u0101, ir pietiekami nor\u0101d\u012bt rindu «(%pipe%\/tmp\/&id)(w)file» vai «(%pipe%\/tmp\/;id)(r)file». <\/p>\n

Atg\u0101din\u0101m, ka ievainojam\u012bbas Ghostscript rada paaugstin\u0101tu b\u012bstam\u012bbu, jo \u0161is pakotne tiek izmantota daudzos popul\u0101ros lietojumprogrammu form\u0101tos PostScript un PDF apstr\u0101dei. Piem\u0113ram, Ghostscript tiek izsaukts miniaturu izveides proces\u0101 darbvirsm\u0101, fonisk\u0101s datu indeks\u0113\u0161anas laik\u0101 un att\u0113lu p\u0101rveido\u0161anas proces\u0101. Lai veiksm\u012bgi uzbruktu, daudzk\u0101rt pietiek vienk\u0101r\u0161i aug\u0161upiel\u0101d\u0113t failu ar eksploit\u0101ciju vai apskat\u012bt katalogu ar to failu failu p\u0101rvaldniek\u0101, kas atbalsta dokumentu s\u012bkm\u0113ru par\u0101d\u012b\u0161anu, piem\u0113ram, Nautilus. <\/p>\n

Ievainojam\u012bbas Ghostscript ar\u012b var izmantot, izmantojot att\u0113lu apstr\u0101d\u0101t\u0101jus, kas balst\u012bti uz ImageMagick un GraphicsMagick, nododot tiem JPEG vai PNG failu, kur\u0101 viet\u0101 att\u0113la atrodas PostScript kods (\u0161\u0101ds fails tiks apstr\u0101d\u0101ts Ghostscript, jo MIME tips tiek atpaz\u012bts p\u0113c satura, nevis balstoties uz papla\u0161in\u0101jumu).
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Ghostscript, \u043d\u0430\u0431\u043e\u0440\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 PostScript \u0438 PDF, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3781), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0431\u0440\u0430\u0442\u0438\u043b \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u042d\u043c\u0438\u043b\u044c \u041b\u0435\u0440\u043d\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 25 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 \u043d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u0421\u0430\u043d\u043a\u0442-\u041f\u0435\u0442\u0435\u0440\u0431\u0443\u0440\u0433\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 ZeroNights X (\u0432 \u0434\u043e\u043a\u043b\u0430\u0434\u0435 \u0431\u044b\u043b\u043e \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043d\u043e, \u043a\u0430\u043a \u042d\u043c\u0438\u043b\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101245","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ievainojam\u012bba Ghostscript, kas tiek izmantojama, izmantojot ImageMagick | ProHoster","description":"Ghostscript, r\u012bku komplekts dokumentu apstr\u0101dei, p\u0101rveido\u0161anai un \u0123ener\u0113\u0161anai form\u0101tos PostScript un PDF, ir atkl\u0101ta kritiska ievainojam\u012bba (CVE-2021-3781), kas \u013cauj izpild\u012bt patva\u013c\u012bgu kodu.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Ghostscript, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0447\u0435\u0440\u0435\u0437 ImageMagick | ProHoster","og:description":"\u0412 Ghostscript, \u043d\u0430\u0431\u043e\u0440\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 PostScript \u0438 PDF, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3781), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-10T20:22:37+00:00","article:modified_time":"2021-09-10T20:22:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101245","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-10 20:33:41","updated":"2022-09-28 11:47:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/101245","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=101245"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/101245\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=101245"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=101245"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=101245"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}