Debian DSA-6550-1: Ghostscript Document-Processing RCE and DoS — Detection, Patching, and Hardening Guide

---
title: Ghostscript Process Spawning Shell or Command Interpreter
id: 3f9c1a72-8b4d-4e61-9a25-7d3e5f0b12c8
status: experimental
description: Detects the Ghostscript interpreter (gs) spawning a shell, scripting interpreter, or command utility — consistent with code execution via a malicious PostScript/PDF document (Debian DSA-6550-1 class flaws). Document rendering never requires a child shell.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6550-1-ghostscript
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1203
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/gs'
      - '/gswin64c'
      - '/gswin32c'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare legacy print filters; investigate any hit rather than tuning out
level: critical
---
title: Ghostscript Executed by Web Server or Service Account
id: 8e2b5d14-6c7a-4f93-b1d8-2a9e4c6f5031
status: experimental
description: Identifies gs execution where the parent process is a web server, PHP runtime, or application server — an indicator that an upload/preview/conversion feature is processing documents and is exposed to Ghostscript document-parsing flaws.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6550-1-ghostscript
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: '/gs'
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/nginx'
      - '/php-fpm'
      - '/php'
      - '/node'
      - '/java'
      - '/gunicorn'
      - '/uwsgi'
  condition: selection_img and selection_parent
falsepositives:
  - Legitimate document preview/conversion features — use this as an inventory rule to find every internet-reachable Ghostscript invocation path, then confirm those hosts are patched
level: medium
---
title: Outbound Network Connection from Ghostscript Process
id: b47d91e3-2f58-4a06-8c3d-5e1f7a9b2064
status: experimental
description: Detects outbound network connections initiated by the Ghostscript binary. A document interpreter has no legitimate reason to establish network connections; this is a strong post-exploitation indicator (payload retrieval, C2, exfiltration).
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6550-1-ghostscript
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith: '/gs'
  filter_loopback:
    DestinationIp|startswith:
      - '127.'
      - '::1'
  condition: selection and not filter_loopback
falsepositives:
  - None expected in standard deployments
level: critical

// Hunt 1: Ghostscript spawning shells or download tools (post-exploitation indicator)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("gs", "gswin64c", "gswin32c")
   or InitiatingProcessCommandLine has_any ("ghostscript")
| where FileName in~ ("sh", "bash", "dash", "zsh", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "powershell.exe", "cmd.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

// Hunt 2: Syslog-ingested Linux hosts — gs executed by web/app tier parents
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_all ("gs", "execve") or SyslogMessage has "/usr/bin/gs"
| where SyslogMessage has_any ("apache2", "nginx", "php-fpm", "cups", "node", "java")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt 3: Inventory — every host where gs ran in the last 7 days (patch prioritization)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "gs" or ProcessCommandLine has "/usr/bin/gs"
| summarize LastRun = max(TimeGenerated), InvocationCount = count(),
            SampleParents = make_set(InitiatingProcessFileName, 10) by DeviceName
| order by InvocationCount desc

-- Ghostscript exposure and exploitation hunt (Debian DSA-6550-1)
-- 1) Enumerate installed ghostscript package version for patch verification
LET pkg = SELECT * FROM execve(argv=['dpkg-query', '-W', '-f=${Version}', 'ghostscript'])

-- 2) Live processes: gs with suspicious children or network connections
LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '/gs$' OR CommandLine =~ 'ghostscript'

-- 3) Network connections held by any gs process (should be none)
LET net = SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Name =~ 'gs'

SELECT * FROM procs
UNION ALL
SELECT Pid, NULL AS Ppid, Name, NULL AS CommandLine,
       Laddr AS Exe, Raddr AS Username, NULL AS CreateTime
FROM net

#!/usr/bin/env bash
# DSA-6550-1 Ghostscript remediation + verification — Debian trixie
# Run as root (or via sudo) on each affected host.

set -euo pipefail

echo "=== [1/5] Current Ghostscript package state ==="
dpkg-query -W -f='${Package} ${Version} ${Status}\n' ghostscript libgs* 2>/dev/null || true
command -v gs >/dev/null && gs --version || echo "gs binary not in PATH"

echo "=== [2/5] Refreshing package metadata and applying security updates ==="
apt-get update
apt-get install --only-upgrade -y ghostscript libgs10 libgs-common 2>/dev/null \
  || apt-get install --only-upgrade -y ghostscript

echo "=== [3/5] Post-patch verification ==="
NEWVER="$(dpkg-query -W -f='${Version}' ghostscript)"
echo "Installed ghostscript version: ${NEWVER}"
echo "Cross-reference against DSA-6550-1 fixed version:"
echo "  https://linuxsecurity.com/advisories/debian/debian-dsa-6550-1-ghostscript"
echo "  https://security-tracker.debian.org/tracker/source-package/ghostscript"

echo "=== [4/5] Identify running services still holding old libgs ==="
# needrestart flags processes using deleted/upgraded libraries
if command -v needrestart >/dev/null; then
  needrestart -r l -k 2>/dev/null || true
else
  echo "needrestart not installed — manually restart cups and any conversion services:"
  echo "  systemctl try-restart cups cups-browsed 2>/dev/null"
fi

echo "=== [5/5] Audit: which services can reach gs? ==="
# Find ImageMagick policies that still permit PS/PDF coders (should be disabled if unused)
grep -Ril 'coder' /etc/ImageMagick*/policy.xml 2>/dev/null | while read -r f; do
  echo "--- ${f} ---"
  grep -E 'PS|PDF|EPS|XPS' "${f}" || echo "  (no PS/PDF coder policy lines — gs may still be reachable)"
done
# List recent gs invocations from journal for anomaly review
journalctl --since "-7 days" --no-pager 2>/dev/null | grep -i '/gs' | tail -n 20 || true

echo "=== Done. Re-run dpkg-query after any container rebuilds; containers are patched by rebuilding images, not by this script. ==="