Vulnerability Name:

CVE-2008-0411 (CCN-40881)

Assigned:2008-02-27
Published:2008-02-27
Updated:2018-10-15
Summary:Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a .seticcspace operator.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-119
CWE-121
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2008-0411

Source: SUSE
Type: UNKNOWN
SUSE-SA:2008:010

Source: CCN
Type: RHSA-2008-0155
Important: ghostscript security update

Source: MISC
Type: Exploit
http://scary.beasts.org/security/CESA-2008-001.html

Source: SECUNIA
Type: UNKNOWN
29101

Source: CCN
Type: SA29103
Ghostscript "zseticcspace()" Buffer Overflow Vulnerability

Source: SECUNIA
Type: UNKNOWN
29103

Source: SECUNIA
Type: UNKNOWN
29112

Source: SECUNIA
Type: UNKNOWN
29135

Source: SECUNIA
Type: UNKNOWN
29147

Source: SECUNIA
Type: UNKNOWN
29154

Source: SECUNIA
Type: UNKNOWN
29169

Source: SECUNIA
Type: UNKNOWN
29196

Source: SECUNIA
Type: UNKNOWN
29314

Source: SECUNIA
Type: UNKNOWN
29768

Source: CCN
Type: SECTRACK ID: 1019511
Ghostscript Stack Overflow in zseticcspace() Lets Remote Users Execute Arbitrary Codes

Source: SLACKWARE
Type: UNKNOWN
SSA:2008-062-01

Source: CCN
Type: ASA-2008-091
ghostscript security update (RHSA-2008-0155)

Source: CONFIRM
Type: UNKNOWN
http://wiki.rpath.com/Advisories:rPSA-2008-0082

Source: DEBIAN
Type: Patch
DSA-1510

Source: DEBIAN
Type: DSA-1510
ghostscript -- buffer overflow

Source: GENTOO
Type: UNKNOWN
GLSA-200803-14

Source: CCN
Type: Ghostscript Web site
Ghostscript

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2008:055

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0155

Source: BUGTRAQ
Type: UNKNOWN
20080228 rPSA-2008-0082-1 espgs

Source: BUGTRAQ
Type: UNKNOWN
20080228 Ghostscript buffer overflow

Source: BID
Type: UNKNOWN
28017

Source: CCN
Type: BID-28017
Ghostscript zseticcspace() Function Buffer Overflow Vulnerability

Source: SECTRACK
Type: UNKNOWN
1019511

Source: CCN
Type: USN-599-1
Ghostscript vulnerability

Source: UBUNTU
Type: UNKNOWN
USN-599-1

Source: VUPEN
Type: UNKNOWN
ADV-2008-0693

Source: XF
Type: UNKNOWN
ghostscript-zseticcspace-bo(40881)

Source: CONFIRM
Type: UNKNOWN
https://issues.rpath.com/browse/RPL-2217

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:9557

Source: FEDORA
Type: UNKNOWN
FEDORA-2008-1998

Source: SUSE
Type: SUSE-SA:2008:010
Ghostscript Security Problems

Vulnerable Configuration:Configuration 1:
  • cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:alpha:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:amd64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:arm:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:hppa:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:ia-32:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:ia-64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:m68k:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:mips:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:mipsel:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:ppc:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:s-390:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:sparc:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:alpha:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:amd64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:arm:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:hppa:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:ia-32:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:ia-64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:m68k:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:mips:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:mipsel:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:powerpc:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:s-390:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:sparc:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.0_x86_64:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1:*:x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrakesoft_corporate_server:3.0_x86_64:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrakesoft_corporate_server:4.0_x86_64:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:desktop:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:desktop:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:as_3:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:as_4:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:es_3:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:es_4:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:ws_3:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:ws_4:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:5:*:client:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop_workstation:5:*:client:*:*:*:*:*
  • OR cpe:/o:rpath:rpath_linux:1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:novell_linux_pos:9:*:*:*:*:*:*:*
  • OR cpe:/o:suse:open_suse:10.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:open_suse:10.3:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.0:*:enterprise_server:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10:sp1:enterprise_desktop:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10:sp1:enterprise_server:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10.1:*:ppc:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10.1:*:x86:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10.1:*:x86_64:*:*:*:*:*
  • OR cpe:/o:suse:suse_open_enterprise_server:0:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ghostscript:ghostscript:*:*:*:*:*:*:*:* (Version <= 8.61)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:alpha:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:amd64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:arm:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:hppa:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:ia-32:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:ia-64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:m68k:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:mips:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:mipsel:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:ppc:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:s-390:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:sparc:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:alpha:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:amd64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:arm:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:hppa:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:ia-32:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:ia-64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:m68k:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:mips:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:mipsel:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:powerpc:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:s-390:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:sparc:*:*:*:*:*
  • AND
  • cpe:/a:ghostscript:ghostscript:0:*:*:*:*:*:*:*
  • OR cpe:/a:ghostscript:ghostscript:8.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ghostscript:ghostscript:8.15:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:5::client_workstation:*:*:*:*:*

    • Configuration RedHat 9:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20080411
    V
    		CVE-2008-0411
    2015-11-16
    oval:org.mitre.oval:def:16848
    P
    		USN-599-1 -- ghostscript, gs-esp, gs-gpl vulnerability
    2014-06-30
    oval:org.mitre.oval:def:20095
    P
    		DSA-1510-1 gs-esp gs-gpl - arbitrary code execution
    2014-06-23
    oval:org.mitre.oval:def:7775
    P
    		DSA-1510 gs-esp gs-gpl -- buffer overflow
    2014-06-23
    oval:org.mitre.oval:def:22430
    P
    		ELSA-2008:0155: ghostscript security update (Important)
    2014-05-26
    oval:org.mitre.oval:def:9557
    V
    		Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a .seticcspace operator.
    2013-04-29
    oval:com.redhat.rhsa:def:20080155
    P
    		RHSA-2008:0155: ghostscript security update (Important)
    2008-03-20
    oval:org.debian:def:1510
    V
    		buffer overflow
    2008-02-27
    BACK
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    mandrakesoft mandrake linux 2007
    mandrakesoft mandrake linux 2007.0_x86_64
    mandrakesoft mandrake linux 2007.1
    mandrakesoft mandrake linux 2007.1
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux corporate server 3.0
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrakesoft corporate server 3.0_x86_64
    mandrakesoft mandrakesoft corporate server 4.0_x86_64
    redhat desktop 3.0
    redhat desktop 4.0
    redhat enterprise linux 5
    redhat enterprise linux as_3
    redhat enterprise linux as_4
    redhat enterprise linux es_3
    redhat enterprise linux es_4
    redhat enterprise linux ws_3
    redhat enterprise linux ws_4
    redhat enterprise linux desktop 5
    redhat enterprise linux desktop workstation 5
    rpath rpath linux 1
    suse novell linux pos 9
    suse open suse 10.2
    suse open suse 10.3
    suse suse linux 9.0
    suse suse linux 10 sp1
    suse suse linux 10 sp1
    suse suse linux 10.1
    suse suse linux 10.1
    suse suse linux 10.1
    suse suse open enterprise server 0
    ghostscript ghostscript *
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 3.1
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    debian debian linux 4.0
    ghostscript ghostscript 0
    ghostscript ghostscript 8.0.1
    ghostscript ghostscript 8.15