> From [EMAIL PROTECTED] Fri Dec 28 14:29:03 2001
> Date: Fri, 28 Dec 2001 16:18:14 -0500 (EST)
> From: Carl Riches <[EMAIL PROTECTED]>
> To: <[EMAIL PROTECTED]>
> Subject: Re: LPRng: AFPL Ghostscript 7.03 with suggested -dSAFER modification
>
>
> After doing more testing, the modification I made to gs_init.ps doesn't
> work properly with .pdf files. Both ps2pdf and pdf2ps fail with this
> message:
>
> Unrecoverable error: invalidfileaccess in w
> Operand stack:
> %stdout
>
> The modification is good for passing the ifhp security test, but doesn't
> work in production.
>
> Sorry! Perhaps there's a PostScript programmer on the list who could fix
> this?
>
> Carl G. Riches
> Software Engineer
> Department of Mathematics
> Box 354350 voice: 206-543-5082 or 206-616-3636
> University of Washington fax: 206-543-0397
> Seattle, WA 98195-4350 internet: [EMAIL PROTECTED]
This implies that there is a gaping security loophole in ps2pdf and pdf2ps
that, when used by root, can cause a system compromise.
In the README.GhostScript file I noted that this problem has more
consequences than just to printing.
Isn't a security loophole in a utility WONDERFUL?
Patrick ("CERT Advisory Blaming LPRng? Yeah, shoot the
messenger, blame the innocent, reward the guilty...") Powell
-----------------------------------------------------------------------------
YOU MUST BE A LIST MEMBER IN ORDER TO POST TO THE LPRNG MAILING LIST
The address you post from MUST be your subscription address
If you need help, send email to [EMAIL PROTECTED] (or lprng-requests
or lprng-digest-requests) with the word 'help' in the body. For the impatient,
to subscribe to a list with name LIST, send mail to [EMAIL PROTECTED]
with: | example:
subscribe LIST <mailaddr> | subscribe lprng-digest [EMAIL PROTECTED]
unsubscribe LIST <mailaddr> | unsubscribe lprng [EMAIL PROTECTED]
If you have major problems, send email to [EMAIL PROTECTED] with the word
LPRNGLIST in the SUBJECT line.
-----------------------------------------------------------------------------
