CVE-2018-11645 : What You Need to Know

In Artifex Ghostscript versions prior to 9.21rc1, a vulnerability exists in the psi/zfile.c file that allows the execution of the status command, even when the -dSAFER flag is used. This flaw could potentially enable remote attackers to determine the presence and size of arbitrary files, similar to CVE-2016-7977.

Understanding CVE-2018-11645

Artifex Ghostscript versions prior to 9.21rc1 are susceptible to a security issue that allows unauthorized execution of the status command, potentially leading to information disclosure.

What is CVE-2018-11645?

This CVE refers to a vulnerability in Artifex Ghostscript versions before 9.21rc1 that permits the execution of the status command, even when the -dSAFER flag is utilized. This weakness could be exploited by remote attackers to identify the existence and size of arbitrary files.

The Impact of CVE-2018-11645

The vulnerability in Artifex Ghostscript could have severe consequences:

Remote attackers may ascertain the presence of arbitrary files.
Unauthorized disclosure of file sizes could occur.

Technical Details of CVE-2018-11645

Artifex Ghostscript's vulnerability has the following technical aspects:

Vulnerability Description

The psi/zfile.c file in Artifex Ghostscript before 9.21rc1 allows the execution of the status command, even when the -dSAFER flag is used, potentially leading to unauthorized file information disclosure.

Affected Systems and Versions

Product: Not applicable
Vendor: Not applicable
Versions: All versions before 9.21rc1

Exploitation Mechanism

The vulnerability enables remote attackers to execute the status command, bypassing the -dSAFER flag, which could allow them to determine the presence and size of arbitrary files.

Mitigation and Prevention

To address CVE-2018-11645, consider the following mitigation strategies:

Immediate Steps to Take

Update Artifex Ghostscript to version 9.21rc1 or later to mitigate the vulnerability.
Implement proper access controls to restrict unauthorized access to sensitive files.

Long-Term Security Practices

Regularly monitor and update software to patch known vulnerabilities.
Conduct security assessments and audits to identify and remediate potential weaknesses.

Patching and Updates

Apply security patches and updates provided by Artifex to address the vulnerability in Ghostscript.