Synology-SA-18:49 Ghostscript

Publish Time: 2018-08-23 13:52:41 UTC+8

Last Updated: 2021-07-09 11:34:09 UTC+8

Severity
Important
Status
Resolved

Abstract

A vulnerability allows remote authenticated users to execute arbitrary commands via a susceptible version of Synology DiskStation Manager (DSM) and Synology Router Manager (SRM) when the AirPrint feature is enabled.

Affected Products

Product Severity Fixed Release Availability
DSM 7.0 Not affected N/A
DSM 6.2 Important Upgrade to 7.0-41890 or above.
DSM 6.1 Important Will be fixed in DSM 6.2.
DSM 5.2 Important Will be fixed in DSM 6.2.
SkyNAS Not affected N/A
VS960HD Not affected N/A
SRM 1.1 Important Will not fix
File Station Not affected N/A
Photo Station Not affected N/A

Mitigation

None

Detail

  • CVE-2018-16509
    • Severity: Important
    • CVSS3 Base Score: 8.8
    • CVSS3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
    • An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.

Reference

Revision

Revision Date Description
1 2018-08-23 Initial public release.
2 2018-08-23 Updated Abstract and Affected Products.
3 2020-10-28 Updated Affected Products for SRM 1.1 which will not be fixed.
4 2021-06-29 Added DSM 7.0 to Affected Products.
5 2021-06-29 Update for DSM 6.2 is now available in Affected Products.