CVE-2024-29506
📋 TL;DR
This vulnerability is a stack-based buffer overflow in Artifex Ghostscript's pdfi_apply_filter() function that can be triggered by a malicious PDF file with an overly long filter name. Attackers could exploit this to execute arbitrary code or cause denial of service. Any system processing PDF files with vulnerable Ghostscript versions is affected.
💻 Affected Systems
- Artifex Ghostscript
📦 What is this software?
Ghostscript by Artifex
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the Ghostscript process, potentially leading to full system compromise.
Likely Case
Denial of service (application crash) when processing malicious PDF files.
If Mitigated
Limited impact if Ghostscript runs in sandboxed environments with minimal privileges.
🎯 Exploit Status
Exploitation requires crafting a malicious PDF file, but no public proof-of-concept is available yet.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.03.0
Vendor Advisory: https://bugs.ghostscript.com/show_bug.cgi?id=707510
Restart Required: Yes
Instructions:
1. Download Ghostscript 10.03.0 or later from official sources. 2. Stop all Ghostscript services. 3. Install the updated version. 4. Restart services.
🔧 Temporary Workarounds
Disable PDF processing
allTemporarily disable Ghostscript PDF processing in applications until patched.
Sandbox Ghostscript
linuxRun Ghostscript in a container or with reduced privileges to limit impact.
docker run --read-only --cap-drop=ALL ghostscript
🧯 If You Can't Patch
- Implement strict input validation to reject PDFs with unusually long filter names.
- Deploy network segmentation to isolate Ghostscript services from untrusted networks.
🔍 How to Verify
Check if Vulnerable:
Check Ghostscript version with 'gs --version' and verify it's below 10.03.0.Check Version:
gs --versionVerify Fix Applied:
Confirm version is 10.03.0 or higher using 'gs --version'.📡 Detection & Monitoring
Log Indicators:
- Ghostscript crash logs
- Application errors when processing PDF files
Network Indicators:
- Unusual PDF file uploads to services using Ghostscript
SIEM Query:
source="*ghostscript*" AND (event="crash" OR event="segfault")🔗 References
- https://bugs.ghostscript.com/show_bug.cgi?id=707510
- https://git.ghostscript.com/?p=ghostpdl.git%3Bh=77dc7f699beba606937b7ea23b50cf5974fa64b1
- https://www.openwall.com/lists/oss-security/2024/07/03/7
- https://bugs.ghostscript.com/show_bug.cgi?id=707510
- https://git.ghostscript.com/?p=ghostpdl.git%3Bh=77dc7f699beba606937b7ea23b50cf5974fa64b1
- https://www.openwall.com/lists/oss-security/2024/07/03/7
