Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 10 Sep 2012 14:48:38 -0600
From: Vincent Danen <>
Cc: Tavis Ormandy <>
Subject: Re: note on gnome shell extensions

* [2012-09-08 18:14:10 -0600] Kurt Seifried wrote:

>Hash: SHA1
>On 09/08/2012 04:36 PM, Tavis Ormandy wrote:
>> List, I just installed Fedora 17 on a workstation. While
>> researching how to upgrade gnome 3 to version 2, I noticed it
>> installed a browser extension called "Gnome Shell Integration".
>> $ rpm -qf
>> /usr/lib64/mozilla/plugins/
>> gnome-shell-3.4.1-5.fc17.x86_64
>> The NPPVpluginDescriptionString states "It can be used only by
>>", but I happen to know that is a tricky thing
>> to get right.
>Erk yeah not good.
>> The plugin incorrectly trusted hostname, and initialized. As far as
>> I can tell, the plugin will let you install new shell extensions, I
>> don't know what the impact of that is, can they contain native
>> code?
>> Tavis.
>Good news: In theory at least Gnome shell extensions are only
>JavaScript and (optional) CSS using the Gjs bindings, the JavaScript
>itself is run using SpiderMonkey. So no native code execution as far
>as I know.
>Bad news: It looks like it has bindings to run command lines from
>within a Gnome Shell Extensions:

SUSE has some interesting info in their bug:

By the sounds of it, this should be harmless.  Vincent Untz says that
the browser plugin doesn't actually install the extensions, it's passed
to another process via a dbus call to gnome-shell, which sends the uuid
of the extension to the web site in order to
download the extension.


which is:

let message = Soup.form_request_new_from_hash('GET', REPOSITORY_URL_INFO, params);

And REPOSITORY_URL_INFO is hardcoded earlier:

const REPOSITORY_URL_DOWNLOAD = REPOSITORY_URL_BASE + '/download-extension/';
const REPOSITORY_URL_INFO     = REPOSITORY_URL_BASE + '/extension-info/';

I don't think this is something that can be exploited, based on the

Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.