CVE-2019-14817
📋 TL;DR
This vulnerability in Ghostscript allows specially crafted PostScript files to bypass the -dSAFER security sandbox. Attackers could gain file system access or execute arbitrary commands on affected systems. Anyone using Ghostscript versions before 9.50 to process untrusted PostScript/PDF files is affected.
💻 Affected Systems
- Ghostscript
- Applications embedding Ghostscript (ImageMagick, LibreOffice, etc.)
- PDF processing tools using Ghostscript
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Ghostscript by Artifex
Leap by Opensuse
Leap by Opensuse
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary command execution, potentially leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
File system access allowing reading of sensitive files, planting backdoors, or limited command execution within the Ghostscript process context.
If Mitigated
No impact if -dSAFER is not used or if Ghostscript is not exposed to untrusted input.
🎯 Exploit Status
Exploitation requires delivering a malicious PostScript file to a vulnerable Ghostscript instance. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Ghostscript 9.50 and later
Vendor Advisory: https://access.redhat.com/errata/RHSA-2019:2594
Restart Required: No
Instructions:
1. Update Ghostscript to version 9.50 or later. 2. For Linux: Use package manager (apt-get upgrade ghostscript, yum update ghostscript). 3. For Windows: Download from ghostscript.com. 4. Restart any services using Ghostscript.
🔧 Temporary Workarounds
Disable PostScript processing
allConfigure applications to disable PostScript processing or use alternative PDF processors
Sandbox Ghostscript execution
linuxRun Ghostscript in a container or with minimal privileges
docker run --read-only -v /tmp:/tmp ghostscript
sudo -u nobody gs -dSAFER ...
🧯 If You Can't Patch
- Implement strict input validation to reject suspicious PostScript files
- Isolate Ghostscript processes using SELinux/AppArmor or run in dedicated virtual machines
🔍 How to Verify
Check if Vulnerable:
Check Ghostscript version: gs --version. If version is below 9.50, system is vulnerable.Check Version:
gs --versionVerify Fix Applied:
After update, run gs --version and confirm version is 9.50 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual Ghostscript process execution patterns
- Large PostScript file processing errors
- System commands executed from Ghostscript context
Network Indicators:
- Unexpected outbound connections from document processing servers
- File uploads to document processing endpoints followed by command execution
SIEM Query:
process_name:"gs" AND (command_line:"*exec*" OR command_line:"*shell*" OR command_line:"*system*")🔗 References
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=cd1b1cacadac2479e291efe611979bdc1b3bdb19
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html
- https://access.redhat.com/errata/RHBA-2019:2824
- https://access.redhat.com/errata/RHSA-2019:2594
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14817
- https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/
- https://seclists.org/bugtraq/2019/Sep/15
- https://security.gentoo.org/glsa/202004-03
- https://www.debian.org/security/2019/dsa-4518
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=cd1b1cacadac2479e291efe611979bdc1b3bdb19
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00090.html
- https://access.redhat.com/errata/RHBA-2019:2824
- https://access.redhat.com/errata/RHSA-2019:2594
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14817
- https://lists.debian.org/debian-lts-announce/2019/09/msg00007.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBUC4DBBJTRFNCR3IODBV4IXB2C2HI3V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/
- https://seclists.org/bugtraq/2019/Sep/15
- https://security.gentoo.org/glsa/202004-03
- https://www.debian.org/security/2019/dsa-4518
