Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a .seticcspace operator.

From Red Hat Security Advisory 2008:0155 :

Updated ghostscript packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Ghostscript is a program for displaying PostScript files, or printing them to non-PostScript printers.

Chris Evans from the Google Security Team reported a stack-based buffer overflow flaw in Ghostscript's zseticcspace() function. An attacker could create a malicious PostScript file that would cause Ghostscript to execute arbitrary code when opened. (CVE-2008-0411)

These updated packages also fix a bug, which prevented the pxlmono printer driver from producing valid output on Red Hat Enterprise Linux 4.

All users of ghostscript are advised to upgrade to these updated packages, which contain a backported patch to resolve these issues.

Chris Evans from the Google Security Team reported a stack-based buffer overflow flaw in Ghostscript's zseticcspace() function. An attacker could create a malicious PostScript file that would cause Ghostscript to execute arbitrary code when opened. (CVE-2008-0411)

These updated packages also fix a bug, which prevented the pxlmono printer driver from producing valid output on Scientific Linux 4.

A stack-based buffer overflow was fixed in the ghostscript interpreter, which potentially could be used to execute code or at least crash ghostscript. (CVE-2008-0411)

Chris Evans found a buffer overflow condition in Ghostscript, which can lead to arbitrary code execution as the user running any application using it to process a maliciously crafted Postscript file.

The updated packages have been patched to prevent this issue.

Chris Evans discovered that Ghostscript contained a buffer overflow in its color space handling code. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. (CVE-2008-0411).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200803-14 (Ghostscript: Buffer overflow)

    Chris Evans (Google Security) discovered a stack-based buffer overflow     within the zseticcspace() function in the file zicc.c when processing a     PostScript file containing a long 'Range' array in a .seticcscpate     operator.
  Impact :

    A remote attacker could exploit this vulnerability by enticing a user     to open a specially crafted PostScript file, which could possibly lead     to the execution of arbitrary code or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Chris Evans from the Google Security Team reports :

Severity: parsing of evil PostScript file will result in arbitrary code execution.

A stack-based buffer overflow in the zseticcspace() function in zicc.c allows remote arbitrary code execution via a malicious PostScript file (.ps) that contains a long Range array.

This update contains a back-ported fix for a security issue that allows malicious PostScript input files to cause a stack-based buffer overflow (CVE-2008-0411).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update contains a back-ported fix for a security issue that allows malicious PostScript input files to cause a stack-based buffer overflow (CVE-2008-0411). This update also restores JPEG2000 support.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New espgs or ghostscript packages are available for 11.0, 12.0, and
-current to fix a buffer overflow.

A stackbased buffer overflow was fixed in the ghostscript interpreter, which potentially could be used to execute code or at least crash ghostscript. (CVE-2008-0411)

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2008:0155 advisory.

  - ghostscript: stack-based buffer overflow in .seticcspace operator (CVE-2008-0411)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chris Evans discovered a buffer overflow in the color space handling code of the Ghostscript PostScript/PDF interpreter, which might result in the execution of arbitrary code if a user is tricked into processing a malformed file.

Updated ghostscript packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Ghostscript is a program for displaying PostScript files, or printing them to non-PostScript printers.

Chris Evans from the Google Security Team reported a stack-based buffer overflow flaw in Ghostscript's zseticcspace() function. An attacker could create a malicious PostScript file that would cause Ghostscript to execute arbitrary code when opened. (CVE-2008-0411)

These updated packages also fix a bug, which prevented the pxlmono printer driver from producing valid output on Red Hat Enterprise Linux 4.

All users of ghostscript are advised to upgrade to these updated packages, which contain a backported patch to resolve these issues.

ID	Name	Product	Family	Severity
67660	Oracle Linux 3 / 4 / 5 : ghostscript (ELSA-2008-0155)	Nessus	Oracle Linux Local Security Checks	medium
60366	Scientific Linux Security Update : ghostscript on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41196	SuSE9 Security Update : Ghostscript (YOU Patch Number 12074)	Nessus	SuSE Local Security Checks	medium
37312	Mandriva Linux Security Advisory : ghostscript (MDVSA-2008:055)	Nessus	Mandriva Local Security Checks	medium
31848	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : ghostscript, gs-esp, gs-gpl vulnerability (USN-599-1)	Nessus	Ubuntu Local Security Checks	medium
31440	GLSA-200803-14 : Ghostscript: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
31376	FreeBSD : ghostscript -- zseticcspace() function buffer overflow vulnerability (ca8e56d5-e856-11dc-b5af-0017319806e7)	Nessus	FreeBSD Local Security Checks	medium
31365	Fedora 7 : ghostscript-8.15.4-4.fc7 (2008-2084)	Nessus	Fedora Local Security Checks	medium
31364	Fedora 8 : ghostscript-8.61-8.fc8 (2008-1998)	Nessus	Fedora Local Security Checks	medium
31324	Slackware 11.0 / 12.0 / current : espgs/ghostscript (SSA:2008-062-01)	Nessus	Slackware Local Security Checks	medium
31322	openSUSE 10 Security Update : ghostscript-fonts-other (ghostscript-fonts-other-4985)	Nessus	SuSE Local Security Checks	medium
31321	SuSE 10 Security Update : Ghostscript (ZYPP Patch Number 4984)	Nessus	SuSE Local Security Checks	medium
31307	RHEL 4 / 5 : ghostscript (RHSA-2008:0155)	Nessus	Red Hat Local Security Checks	critical
31303	Debian DSA-1510-1 : ghostscript - buffer overflow	Nessus	Debian Local Security Checks	medium
31302	CentOS 3 / 4 / 5 : ghostscript (CESA-2008:0155)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2008-0411

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium