[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Oct 2018 17:04:18 +0200
From: Hanno Böck <hanno@...eck.de>
To: Eddie Chapman <eddie@...k.net>
Cc: oss-security@...ts.openwall.com
Subject: Re: ghostscript: bypassing executeonly to escape
-dSAFER sandbox (CVE-2018-17961)
On Wed, 10 Oct 2018 15:36:52 +0100
Eddie Chapman <eddie@...k.net> wrote:
> But I'm still unclear how "just browsing a website is enough to
> trigger the vulnerability in some common configurations." Are we
> talking about the user looking in their web browser cache directory
> on the filesystem using Nautilus, and hence running malicious code
> embedded in a cached file via the evince thumbnailer on opening that
> directory? Or maybe Nautilus/Gnome automatically runs the thumbnailer
> on every new file created in the user's home directory (via
> inotify?), including whatever the browser saves in the background
> (hopefully not)? Or is it just a case of the user opening a
> downloaded file with evince and becoming a victim that way? Though
> that is not exactly automatic, most browsers show a prompt asking
> what to do with a downloaded file.
I don't know what exactly Tavis was referring to, but a scenario that
has been discussed in the past and likely is still possible in many
configurations is this:
Some browsers (notably chrome) will download files without asking in
their default configuration. So a site can make you download a file and
it ends up in your ~/Downloads dir.
Desktop search tools will automatically index that (tracker from gnome,
baloo from kde). So voila - you can fire up an exploit if you can
exploit anything that tracker or baloo support.
https://scarybeastsecurity.blogspot.com/2016/11/0day-poc-risky-design-decisions-in.html
Though I'm not sure if either of them uses ghostscript, a quick check
it seems that not. You still have the automatic download issue in
chrome, but you'd need to convince your user to open up ~/Downloads in
a file manager. That's a minor not-fully-automatic part, but I guess
it's plausible enough that users will eventually do that at some point.
--
Hanno Böck
https://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
