Re: vulnerabilities of postscript printers

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 2004-01-24, Glynn Clements wrote:
> PostScript has the ability to read/write named files, and nothing
> prohibits an implementation from making peripheral devices or ports
> accessible as named files. E.g. using GhostScript on Linux, the
> following trivial PostScript program sends a WAV file (or the first
> 20kb thereof) to the sound card:
> 
> 	(/dev/dsp) (w) file dup
> 	(foo.wav) (r) file
> 	20000 string readstring pop
> 	writestring flushfile
> 
> [The -dSAFER switch disables file access, and should be used when
> running gs on "untrusted" PostScript files.]
> 

Does this mean, that a Postscript-file is not safer than a MS Word
document?

Shouldnt -dSAFER be then the default option? Or breaks this something
else?

-- 
Georg

[Index of Archives]     [Linux Security]     [Netfilter]     [PHP]     [Yosemite News]     [Linux Kernel]

  Powered by Linux