Bleeping Computer has recently reported on a new vulnerability within Ghostscipt, a widely used library for handling PostScript and PDF files. For those who process documents, especially ones provided by third parties, this vulnerability poses a serious threat as attackers are already exploiting this flaw. Because the vulnerability can lead to remote code execution (RCE), organizations should take immediate action to protect themselves. 

Understanding the Risk Behind Ghostscript’s Vulnerability 

Labeled CVE-2024-29510, the format string vulnerability in Ghostscript gives attackers the opportunity to execute arbitrary commands on a system if it processes a specially crafted PostScript or PDF file. This means that an attacker can potentially take control of your system, steal data, or perform other malicious activities. 

Who is Impacted?

The vulnerability affects all installations of Ghostscript versions 10.03.0 and earlier. It allows attackers to bypass the -dSAFER sandbox (which is enabled by default) because these unpatched versions of Ghostscript do not prevent modifications to the argument strings of the uniprint device after the sandbox has been activated.

Immediate Steps to Take 

Within the Sweet platform, verify if libgs is loaded and executed in any of your workloads.

If it is, you’re at a high risk of exploitation and must update your installation of Ghostscript to v10.03.1 immediately. If it’s not loaded, you’re not under immediate risk, but it would be wise to update anyway.

How Sweet Security Can Help

At Sweet Security, we're committed to keeping your systems safe from any and all threats. Here’s how we can help protect you against the Ghostscript vulnerability:

1. Patch Management: We ensure that all packages, including Ghostscript, are regularly updated with the latest security patches. This is the first line of defense against known vulnerabilities. 
2. Exploitation Evaluation: By evaluating the potentiality of the exploitation according to whether the vulnerability is publicly exposed, is within an executable or loaded packages, and so on, Sweet minimizes the impact of any successful exploitation of vulnerabilities like the one in Ghostscript. This helps contain potential attacks and limit their spread across your network.
3. Advanced Threat Detection: Our sophisticated threat detection systems are designed to identify and block malicious activities, including attempts to exploit vulnerabilities in software like Ghostscript. This proactive approach helps us catch threats before they can cause harm.