Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.os.linux > #51574

Re: A problem with "convert" - security related

Cross-posted to 2 groups.

Show all headers | View raw

Paulo da Silva wrote:
> Às 08:34 de 10/11/18, stepore escreveu:
>> On 11/09/2018 06:35 PM, Paulo da Silva wrote:
>>
>>
>> Don't remove the file, just change this bit:
>> <policy domain="coder" rights="read | write" pattern="PDF" />
> 
> Yes, I know how to possibly fix it. I just removed that file to speed
> things up for just a single command.
> My problem is mainly to understand what are the risks of such utility
> (convert) for having those restrictions in the policy file.
> In particular, why is (or may be) it "dangerous" allowing write to pdf
> files!
> Knowing that I'll try a more definitive solution.
> 
> I'm assuming that the guy(s) who wrote those rules are not crazy :-)

The reference to Ghostscript, comes from the ability to modify
files in the file system using PostScript.

The fix many years ago, was to add a parameter to the command
line for a gs run, which would prevent that. The scripts that come
with the GhostScript package, have been using that parameter
for more than ten years.

There should be no danger creating a file, as when Imagemagick
does it. If Imagemagick calls an already-installed gs, one with
compromised files in the installation, then just about anything
could happen. (This is true of doing anything on a computer.
Maybe my copy of "listdir" has been modified by a bad actor...)

When you run "convert", you're not running it elevated,
so from a process point of view, the risk should be smaller.
It should not be able to modify anything in the root account
directory.

*******

https://www.mankier.com/1/gs

    Safer Mode

    The -dSAFER option disables the "deletefile" and "renamefile"
    operators and prohibits opening piped commands ("%pipe%cmd") ...

These would be issues with later usage of .ps or .pdf files,
and how any viewer or printing process handles documents.

In general, since PDF can also contain Javascript, there is
more than one attack surface present. In Acrobat (reader), there is
a tick box to turn off support for Javascript when viewing PDFs.

The PDF that "convert" makes, should be a pretty simple construct,
as all it needs to do is make an image stream from the image file,
and place page information around the top and bottom of the
page definition. There should be nothing about the file itself
which is dangerous.

HTH,
     Paul

Back to alt.os.linux | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

A problem with "convert" - security related Paulo da Silva <p_s_d_a_s_i_l_v_a_ns@netcabo.pt> - 2018-11-10 02:35 +0000
  Re: A problem with "convert" - security related Paul <nospam@needed.invalid> - 2018-11-10 00:15 -0500
  Re: A problem with "convert" - security related stepore <linshine@here.now> - 2018-11-10 00:34 -0800
    Re: A problem with "convert" - security related Paul <nospam@needed.invalid> - 2018-11-10 07:32 -0500
    Re: A problem with "convert" - security related Paulo da Silva <p_s_d_a_s_i_l_v_a_ns@netcabo.pt> - 2018-11-10 17:19 +0000
      Re: A problem with "convert" - security related Paul <nospam@needed.invalid> - 2018-11-10 17:03 -0500
        Re: A problem with "convert" - security related Paulo da Silva <p_s_d_a_s_i_l_v_a_ns@netcabo.pt> - 2018-11-11 02:45 +0000
          Re: A problem with "convert" - security related Paul <nospam@needed.invalid> - 2018-11-10 23:26 -0500
            Re: A problem with "convert" - security related "Carlos E. R." <robin_listas@es.invalid> - 2018-11-12 14:17 +0100
              Re: A problem with "convert" - security related Paul <nospam@needed.invalid> - 2018-11-12 09:21 -0500
                Re: A problem with "convert" - security related "Carlos E. R." <robin_listas@es.invalid> - 2018-11-12 17:09 +0100

csiph-web