4 ms·

Doesn’t have to be a web browser to be vulnerable to remote code execution. But it is a valid question to ask why it counts as an RCE. On the one hand, they s

Doesn’t have to be a web browser to be vulnerable to remote code execution. But it is a valid question to ask why it counts as an RCE. On the one hand, they say: > Successful exploitation requires user interaction by the victim. And on the other hand > Local: No > Remote: Yes https://vuldb.com/?id.197290 https://vuldb.com/?id.197290 The bugzilla bug tracker for Ghostscript is currently down for maintenance, so can’t browse it for more details at the moment. But I wonder if for example a web server that uses Ghostscript to convert documents could be vulnerable. In which case RCE classification makes sense. Otherwise, do they count it as RCE even if it involves tricking a user into opening a bad file using Ghostscript? If navigating to a bad website with a vulnerable browser counts as RCE in other cases then perhaps opening a bad file with Ghostscript counts as RCE as well?

tedunangst 3y ago
It's remote in the sense the file comes from elsewhere. It's a problem even if you trust your user (yourself), because you probably open files from untrusted people. Local priv escalation is something like a root exploit where you don't trust the user.
- codetrotter 3y ago
  Thanks, that makes sense :)
thaumasiotes 3y ago
> But it is a valid question to ask why it counts as an RCE. It's an RCE because the form of the attack is that Ghostscript ends up executing code that isn't part of Ghostscript. Code is written outside the system ("remote code") and then executed inside it ("execution"). A malicious PDF that causes Ghostscript to execute arbitrary code would contrast with a malicious PDF that causes Ghostscript to execute inappropriate code that is nevertheless part of Ghostscript. The RCE allows the attacker to do anything the computer can do. The other one allows them to do something (but not necessarily anything) that Ghostscript can do.
- worthless-trash 3y ago
  Most attacker controlled execution code does not originate inside the binary, most buffer overflows inject shellcode. Using execution code from outside the binary does not make it an RCE.
wang_li 3y ago
> But I wonder if for example a web server that uses Ghostscript to convert documents could be vulnerable. In which case RCE classification makes sense. If this is an RCE then all bugs that could lead to code execution are RCEs because, theoretically, I can put some piece of code in front of it that listens on the network. This is an unexpected code execution bug. Calling it RCE would suggest that systems that let you double-click on documents to open them are RCEs because I can name an elf executable AliceAndBobAtTheBeach.jpg.

tedunangst 3y ago

It's remote in the sense the file comes from elsewhere. It's a problem even if you trust your user (yourself), because you probably open files from untrusted people. Local priv escalation is something like a root exploit where you don't trust the user.

codetrotter 3y ago
Thanks, that makes sense :)

thaumasiotes 3y ago

> But it is a valid question to ask why it counts as an RCE. It's an RCE because the form of the attack is that Ghostscript ends up executing code that isn't part of Ghostscript. Code is written outside the system ("remote code") and then executed inside it ("execution"). A malicious PDF that causes Ghostscript to execute arbitrary code would contrast with a malicious PDF that causes Ghostscript to execute inappropriate code that is nevertheless part of Ghostscript. The RCE allows the attacker to do anything the computer can do. The other one allows them to do something (but not necessarily anything) that Ghostscript can do.

worthless-trash 3y ago
Most attacker controlled execution code does not originate inside the binary, most buffer overflows inject shellcode. Using execution code from outside the binary does not make it an RCE.

wang_li 3y ago

> But I wonder if for example a web server that uses Ghostscript to convert documents could be vulnerable. In which case RCE classification makes sense. If this is an RCE then all bugs that could lead to code execution are RCEs because, theoretically, I can put some piece of code in front of it that listens on the network. This is an unexpected code execution bug. Calling it RCE would suggest that systems that let you double-click on documents to open them are RCEs because I can name an elf executable AliceAndBobAtTheBeach.jpg.