{"id":101245,"date":"2021-09-10T22:22:37","date_gmt":"2021-09-10T20:22:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick"},"modified":"2021-09-10T22:22:37","modified_gmt":"2021-09-10T20:22:37","slug":"uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick","title":{"rendered":"Vulnerabilitate \u00een Ghostscript exploatat\u0103 prin ImageMagick","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen Ghostscript, un set de instrumente pentru procesarea, transformarea \u0219i generarea documentelor \u00een formatele PostScript \u0219i PDF, a fost descoperit\u0103 o vulnerabilitate critic\u0103 (CVE-2021-3781) care permite executarea de cod arbitrar atunci c\u00e2nd se proceseaz\u0103 un fi\u0219ier special conceput. Problema a fost semnalat\u0103 ini\u021bial de Emil Lerner, care a discutat despre vulnerabilitate pe 25 august la conferin\u021ba ZeroNights X din Sankt Petersburg (\u00een prezentarea sa, Emil a ar\u0103tat cum a folosit vulnerabilitatea \u00een cadrul programelor de bug bounty pentru a ob\u021bine recompense demonstr\u00e2nd atacuri asupra serviciilor AirBNB, Dropbox \u0219i Yandex.Nedvijimost). <\/p>\n

Pe 5 septembrie, a fost publicat un exploit func\u021bional care permite atacarea sistemelor cu Ubuntu 20.04 prin transmiterea unui document special conceput unui script web care folose\u0219te pachetul php-imagemagick, fiind \u00eenc\u0103rcat sub forma unei imagini. De asemenea, se pare c\u0103 un astfel de exploit circula \u00eenc\u0103 din martie. S-a raportat o posibilitate de atac asupra sistemelor cu GhostScript 9.50, dar s-a confirmat c\u0103 vulnerabilitatea se manifest\u0103 \u0219i \u00een toate versiunile ulterioare ale GhostScript, inclusiv \u00een versiunea 9.55 aflat\u0103 \u00een dezvoltare din Git. <\/p>\n

O solu\u021bie a fost propus\u0103 pe 8 septembrie \u0219i, dup\u0103 revizuire, a fost acceptat\u0103 \u00een repositoariul GhostScript pe 9 septembrie. \u00cen multe distribu\u021bii, problema r\u0103m\u00e2ne \u00eenc\u0103 nerezolvat\u0103 (starea public\u0103rii actualiz\u0103rilor poate fi verificat\u0103 pe paginile Debian, Ubuntu, Fedora, SUSE, RHEL, Arch Linux, FreeBSD, NetBSD). Se preconizeaz\u0103 c\u0103 o versiune GhostScript cu vulnerabilitatea corectat\u0103 va fi publicat\u0103 p\u00e2n\u0103 la sf\u00e2r\u0219itul lunii. <\/p>\n

Problema este cauzat\u0103 de posibila ocolire a modului de izolare «-dSAFER» din cauza verific\u0103rii insuficiente a parametrilor dispozitivului Postscript «%pipe%», care permitea executarea de comenzi shell arbitrare. De exemplu, pentru a rula utilitarul id \u00eentr-un document, este suficient s\u0103 specifici linia «(%pipe%\/tmp\/&id)(w)file» sau «(%pipe%\/tmp\/;id)(r)file». <\/p>\n

Amintim c\u0103 vulnerabilit\u0103\u021bile din Ghostscript prezint\u0103 un risc crescut, deoarece acest pachet este utilizat \u00een multe aplica\u021bii populare pentru procesarea formatelor PostScript \u0219i PDF. De exemplu, Ghostscript este apelat \u00een procesul de creare a miniaturilor pe desktop, \u00een indexarea de fond a datelor \u0219i \u00een conversia imaginilor. Pentru a efectua cu succes un atac, \u00een multe cazuri este suficient s\u0103 se \u00eencarce un fi\u0219ier cu un exploit sau s\u0103 se vizualizeze un director cu acesta \u00eentr-un manager de fi\u0219iere care suport\u0103 vizualizarea miniaturilor documentelor, cum ar fi Nautilus. <\/p>\n

Vulnerabilit\u0103\u021bile din Ghostscript pot fi, de asemenea, exploatate prin intermediul handler-elor de imagini bazate pe pachetele ImageMagick \u0219i GraphicsMagick, transmit\u00e2nd un fi\u0219ier JPEG sau PNG, \u00een care, \u00een loc de imagine, se afl\u0103 cod PostScript (acest fi\u0219ier va fi procesat \u00een Ghostscript, deoarece tipul MIME este recunoscut dup\u0103 con\u021binut \u0219i nu se bazeaz\u0103 pe extensie).
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Ghostscript, \u043d\u0430\u0431\u043e\u0440\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 PostScript \u0438 PDF, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3781), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0431\u0440\u0430\u0442\u0438\u043b \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u042d\u043c\u0438\u043b\u044c \u041b\u0435\u0440\u043d\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 25 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 \u043d\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0439 \u0432 \u0421\u0430\u043d\u043a\u0442-\u041f\u0435\u0442\u0435\u0440\u0431\u0443\u0440\u0433\u0435 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 ZeroNights X (\u0432 \u0434\u043e\u043a\u043b\u0430\u0434\u0435 \u0431\u044b\u043b\u043e \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043d\u043e, \u043a\u0430\u043a \u042d\u043c\u0438\u043b\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101245","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een Ghostscript, exploatat\u0103 prin ImageMagick | ProHoster","description":"\u00cen Ghostscript, un set de instrumente pentru procesarea, conversia \u0219i generarea documentelor \u00een formatele PostScript \u0219i PDF, a fost identificat\u0103 o vulnerabilitate critic\u0103 (CVE-2021-3781) care permite executarea de cod arbitrar.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Ghostscript, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0447\u0435\u0440\u0435\u0437 ImageMagick | ProHoster","og:description":"\u0412 Ghostscript, \u043d\u0430\u0431\u043e\u0440\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0430\u0445 PostScript \u0438 PDF, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3781), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-ghostscript-ekspluatiruemaya-cherez-imagemagick","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-10T20:22:37+00:00","article:modified_time":"2021-09-10T20:22:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101245","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-10 20:33:41","updated":"2022-09-28 11:47:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101245","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=101245"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101245\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=101245"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=101245"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=101245"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}