JPCERT-AT-2021-0039
JPCERT/CC
2021-09-13(Initial)
2021-09-29(Update)

I. Overview

On September 9, 2021 (Local Time), Ghostscript provider Artifex Software released a security advisory regarding a vulnerability (CVE-2021-3781)that allows arbitrary command execution in Ghostscript. On a server running Ghostscript, an attacker may execute arbitrary commands by processing content that exploits this vulnerability.

Artifex Software
SECURITY ADVISORY SEPTEMBER 9, 2021 - CVE-2021-3781
https://ghostscript.com/CVE-2021-3781.html

JPCERT/CC has confirmed the material that seems to explain the details of this vulnerability and the Proof-of-Concept code that exploits the vulnerability are made public.

The users of the Ghostscript or Ghostscript-dependent software are recommended to check the information provided by Artifex Software and each distributor and take measures as soon as possible.

II. Affected Products and Versions

The following versions are affected by this vulnerability:

- Ghostscript/GhostPDL 9.54.0
- Ghostscript/GhostPDL 9.53.3
- Ghostscript/GhostPDL 9.52
- Ghostscript/GhostPDL 9.50

If you are using software that depends on Ghostscript or Ghostscript provided by a distributor, please also refer to the information provided by the software provider or distributor.

III. Solution

Artifex Software has released a patch that addresses the vulnerability.

In addition, Ghostscript/GhostPDL 9.55.0, which fixes this vulnerability,is scheduled to be released around the end of September 2021.

Update: September 29, 2021 Update

IV. Workarounds

If it is difficult to take measures against this vulnerability, it is recommended to consider reviewing the filter settings in programs that call Ghostscript such as ImageMagick in order to reduce the impact of attacks that exploit the vulnerability.

According to the information published so far, it has been confirmed that the vulnerability can be exploited by loading a malicious SVG format file. Note that changing the settings may affect the processing of SVG format files, so please consider implementing it depending on the situation.

ImageMagick Studio LLC
Security Policy
https://imagemagick.org/script/security-policy.php

V. References

Artifex Software
SECURITY ADVISORY SEPTEMBER 9, 2021 - CVE-2021-3781
https://ghostscript.com/CVE-2021-3781.html


If you have any information regarding this alert, please contact JPCERT/CC.

Revision History

2021-09-13 First edition
2021-09-29 Updated "III. Solution"

JPCERT Coordination Center (Early Warning Group)
MAIL: ew-info@jpcert.or.jp
https://www.jpcert.or.jp/english/