¡¾Îó²îͨ¸æ¡¿Artifex Ghostscriptí§Òâ´úÂëÖ´ÐÐÎó²î£¨CVE-2024-29510£©
Ðû²¼Ê±¼ä 2024-07-04Ò»¡¢Îó²î¸ÅÊö
Îó²îÃû³Æ | Artifex Ghostscriptí§Òâ´úÂëÖ´ÐÐÎó²î | ||
CVE ID | CVE-2024-29510 | ||
Îó²îÀàÐÍ | ÃûÌÃ×Ö·û´®×¢Èë | ·¢Ã÷ʱ¼ä | 2024-07-04 |
Îó²îÆÀ·Ö | 5.5 | Îó²îÆ·¼¶ | ÖÐΣ |
¹¥»÷ÏòÁ¿ | ÍâµØ | ËùÐèȨÏÞ | ÎÞ |
ʹÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ÊÇ |
PoC/EXP | ÒѹûÕæ | ÔÚҰʹÓà | δ·¢Ã÷ |
GhostscriptÊÇÃÀ¹úArtifex Software¹«Ë¾µÄÒ»¿î¿ªÔ´µÄPostScriptÆÊÎöÆ÷£¬±»ÆÕ±éÓ¦ÓÃÓÚÎĵµ×ª»»ºÍ´òÓ¡·þÎñ¡£
2024Äê7ÔÂ4ÈÕ£¬ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø¼¯ÍÅVSRC¼à²âµ½GhostscriptÖб£´æÒ»¸öí§Òâ´úÂëÖ´ÐÐÎó²î£¨CVE-2024-29510£©£¬ÆäCVSSÆÀ·ÖΪ5.5£¬ÏÖÔÚ¸ÃÎó²îµÄϸ½Ú¼°PoCÒѹûÕæ¡£
Artifex Ghostscript °æ±¾10.03.1֮ǰ£¬ÔÚÆôÓÃSAFERºóGhostscript ²»»á×èÖ¹¶Ôuniprint ×°±¸²ÎÊý×Ö·û´®µÄ¸ü¸Ä£¬´Ó¶øµ¼ÖÂÃûÌÃ×Ö·û´®Îó²î£¬ÍþвÕß¿ÉʹÓøÃÎó²îÆÆËðÄÚ´æ²¢ÈƹýSAFERɳºÐ£¬ÀÖ³ÉʹÓÿÉÄܵ¼ÖÂí§Òâ´úÂëÖ´ÐС£
¶þ¡¢Îó²î¸´ÏÖ
Èý¡¢Ó°Ïì¹æÄ£
Ghostscript < 10.03.1
×¢£ºÐí¶à Linux ¿¯ÐаæÖÐĬÈÏ×°Öà Ghostscript£¬²¢ÇÒÐí¶à´òӡϵͳºÍÈí¼þ¶¼Ê¹ÓÃGhostscript£¬ÈçLibreOffice¡¢GIMP¡¢Inkscape¡¢ScribusºÍCUPS´òӡϵͳµÈ¡£
±ðµÄ£¬¸ÃÎó²î¿ÉÄܱ»ÓÃÓÚ´¹ÂÚ¹¥»÷£¬Í¨¹ýÓÕµ¼Ä¿µÄÊܺ¦Õß·¿ªÌØÖƶñÒâÎĵµµ¼ÖÂÔ¶³Ì´úÂëÖ´ÐУ¬ºÃ±È¿Éͨ¹ý½«¶ñÒâEPSÎļþǶÈëµ½LibreOfficeÎĵµÖÐÌìÉúODTÎļþ£¬µ±Êܺ¦Õßͨ¹ýLibreOffice·¿ªÊ±½«µ¼Ö´úÂëÖ´ÐС£
ËÄ¡¢Çå¾²²½·¥
4.1 Éý¼¶°æ±¾
ÏÖÔÚ¸ÃÎó²îÒѾÐÞ¸´£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½ÒÔÏ°汾£º
Ghostscript >= 10.03.1
ÏÂÔØÁ´½Ó£º
https://ghostscript.com/releases/gsdnld.html
4.2 ÔÝʱ²½·¥
ÔÝÎÞ¡£
4.3 ͨÓý¨Òé
l °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬ïÔÌϵͳÎó²î£¬ÌáÉý·þÎñÆ÷µÄÇå¾²ÐÔ¡£
l ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬Ð޸ķÀ»ðǽսÂÔ£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬ïÔ̽«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬ïÔ̹¥»÷Ãæ¡£
l ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£
l ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔÔò£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£
l ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£
4.4 ²Î¿¼Á´½Ó
https://bugs.ghostscript.com/show_bug.cgi?id=707662
https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/
https://www.openwall.com/lists/oss-security/2024/07/03/7
Îå¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2024-07-04 | Ê×´ÎÐû²¼ |
Áù¡¢¸½Â¼
6.1 ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø¼ò½é
ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø½¨ÉèÓÚ1996Ä꣬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Çå¾²·þÎñ½â¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø´óÏ㬹«Ë¾Ô±¹¤6000ÓàÈË£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕ·þÎñÍŶÓ1300ÓàÈË¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ù·þÎñ£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·Åƶø²»Ð¸Æ𾢡£
6.2 ¹ØÓÚÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍø
ÓÅ·¢¹ú¼ÊÍøÕ¾¹ÙÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸öÎó²îͨ¸æºÍΣº¦Ô¤¾¯£¬ÎÒÃǽ«Ò»Á¬¸ú×ÙÈ«Çò×îеÄÍøÂçÇå¾²ÊÂÎñºÍÎó²î£¬ÎªÆóÒµµÄÐÅÏ¢Çå¾²±£¼Ý»¤º½¡£
¹Ø×¢ÎÒÃÇ£º