CVE-2024-29510 – Exploiting Ghostscript using format strings • Hacker News Board

CVE-2024-29510 – Exploiting Ghostscript using format strings

#1

Post by ThomasRinsma » Tue, Jul 02, 2024, 2:31 PM UTC

CVE-2024-29510 – Exploiting Ghostscript using format strings
codeanlabs.com

Re: CVE-2024-29510 – Exploiting Ghostscript using format strings

#2

Post by mistrial9 » Tue, Jul 02, 2024, 6:23 PM UTC

for v10.03 or less from the article.. patched in Debian systems last May ?

https://tracker.debian.org/pkg/ghostscript

Re: CVE-2024-29510 – Exploiting Ghostscript using format strings

#3

Post by pryelluw » Tue, Jul 02, 2024, 6:24 PM UTC

Friendly question given the fatigue around bs critical CVEs. Is this properly rated?

Re: CVE-2024-29510 – Exploiting Ghostscript using format strings

#4

Post by pvg » Tue, Jul 02, 2024, 6:41 PM UTC

pryelluw wrote: post #3

Friendly question given the fatigue around bs critical CVEs. Is this properly rated?

The article describes the vulnerability in some detail so you don't have to rely on the rating at all. In fact, you can completely ignore any mention of CVEs lose nothing.

Re: CVE-2024-29510 – Exploiting Ghostscript using format strings

#5

Post by nieve » Tue, Jul 02, 2024, 7:07 PM UTC

pryelluw wrote: post #3

Friendly question given the fatigue around bs critical CVEs. Is this properly rated?

It allows full RCE from an uploaded or opened file. That seems reasonably critical to me.

Re: CVE-2024-29510 – Exploiting Ghostscript using format strings

#6

Post by out_of_protocol » Tue, Jul 02, 2024, 8:38 PM UTC

nieve wrote: post #5

pryelluw wrote: post #3

Friendly question given the fatigue around bs critical CVEs. Is this properly rated?

It allows full RCE from an uploaded or opened file. That seems reasonably critical to me.

Does this work with .pdf files? i.e. attacker uploads evil.pdf

Re: CVE-2024-29510 – Exploiting Ghostscript using format strings

#7

Post by SkyPuncher » Tue, Jul 02, 2024, 10:17 PM UTC

pryelluw wrote: post #3

Friendly question given the fatigue around bs critical CVEs. Is this properly rated?

If I see a vulnerability in Ghostscript, I basically assume is full RCE at this point..

Re: CVE-2024-29510 – Exploiting Ghostscript using format strings

#8

Post by olliej » Wed, Jul 03, 2024, 3:14 AM UTC

%n strikes again.

I believe that by default on osx %n is only respected if the format string is in readonly memory, I thought the default in Linux was to just ignore it?

Re: CVE-2024-29510 – Exploiting Ghostscript using format strings

#9

Post by llimllib » Wed, Jul 03, 2024, 12:37 PM UTC

out_of_protocol wrote: post #6

nieve wrote: post #5

Earlier quoted context omitted.

It allows full RCE from an uploaded or opened file. That seems reasonably critical to me.

Does this work with .pdf files? i.e. attacker uploads evil.pdf

yes, also with .eps files

Re: CVE-2024-29510 – Exploiting Ghostscript using format strings

#10

Post by worthless-trash » Tue, Jul 09, 2024, 8:42 AM UTC

nieve wrote: post #5

pryelluw wrote: post #3

Friendly question given the fatigue around bs critical CVEs. Is this properly rated?

It allows full RCE from an uploaded or opened file. That seems reasonably critical to me.

Thats.. in bad faith.

If thats the qualification for "remote" then you can say that every attack is remote and it clearly isnt.