On Sat, Nov 10, 2007 at 09:41:43PM -0500, Chuck Robey wrote: > Reko Turja wrote: >>> Dear all, >>> >>> Today I saw a security notice: >> ..snip... >>> cat distinfo >>> MD5 (cups-1.3.3-source.tar.bz2) = d4911e68b6979d16bc7a55f68d16cc53 >>> SHA256 (cups-1.3.3-source.tar.bz2) = >>> 5e9e5670777055293e309cb0cbb2758df9c1275bf648df70478b7389c2d804de >>> SIZE (cups-1.3.3-source.tar.bz2) = 4077262 >> Update your ports and INDEX file as it seems that you are installing a >> vulnerable version of cups-base. The VuXML report says: >> Affects: >> cups-base <1.3.4 >> so the cups-1.3.3 still has the vulnerability mentioned in the report. > > Actually, I think the worst security problem I've seen is one I don't > personally care to fix right now, but I guess I will soon. It's the fact > that postscript is actually a language, one that's more general purpose in > limitations than many people realize. Isn't that true? I think this means > that my postscript interpreter (which is, for me, and I think for most, is > ghostscript) should have some security controls on it, to limit > postscript's direct access to local machine capabilities.
When using ghostscript you should always call it with the -dSAFER option, so it can only open files read-only. Or you could buy a postscript capable printer. > I think that the options in gs for security are too little. It'd be pretty > easy to write a really nasty worm. I remember laughing at my Windows > friends, back when that Philappines worm hit, but we could get pretty > easily hit on gs, or am I all wet? It's not as easy as it seems. It would be possible to write a postscript program that mails itself to other addresses. But no UNIX mail client that I know of automatically opens and renders postscript code, let alone with root privileges, which you need to do _real_ damage instead of just annoy people. So you'd need user intervention to spread the virus. And gathering addresses isn't straightforward either. Every mail program has it's own file for storing those. And there are usually multiple places where mail can be stored, and that can be in at least two formats (mbox and maildir). Roland -- R.F.Smith http://www.xs4all.nl/~rsmith/ [plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated] pgp: 1A2B 477F 9970 BA3C 2914 B7CE 1277 EFB0 C321 A725 (KeyID: C321A725)
Description: PGP signature