Date: Wed, 10 Oct 2018 17:04:18 +0200 From: Hanno Böck <hanno@...eck.de> To: Eddie Chapman <eddie@...k.net> Cc: oss-security@...ts.openwall.com Subject: Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) On Wed, 10 Oct 2018 15:36:52 +0100 Eddie Chapman <eddie@...k.net> wrote: > But I'm still unclear how "just browsing a website is enough to > trigger the vulnerability in some common configurations." Are we > talking about the user looking in their web browser cache directory > on the filesystem using Nautilus, and hence running malicious code > embedded in a cached file via the evince thumbnailer on opening that > directory? Or maybe Nautilus/Gnome automatically runs the thumbnailer > on every new file created in the user's home directory (via > inotify?), including whatever the browser saves in the background > (hopefully not)? Or is it just a case of the user opening a > downloaded file with evince and becoming a victim that way? Though > that is not exactly automatic, most browsers show a prompt asking > what to do with a downloaded file. I don't know what exactly Tavis was referring to, but a scenario that has been discussed in the past and likely is still possible in many configurations is this: Some browsers (notably chrome) will download files without asking in their default configuration. So a site can make you download a file and it ends up in your ~/Downloads dir. Desktop search tools will automatically index that (tracker from gnome, baloo from kde). So voila - you can fire up an exploit if you can exploit anything that tracker or baloo support. https://scarybeastsecurity.blogspot.com/2016/11/0day-poc-risky-design-decisions-in.html Though I'm not sure if either of them uses ghostscript, a quick check it seems that not. You still have the automatic download issue in chrome, but you'd need to convince your user to open up ~/Downloads in a file manager. That's a minor not-fully-automatic part, but I guess it's plausible enough that users will eventually do that at some point. -- Hanno Böck https://hboeck.de/ mail/jabber: hanno@...eck.de GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.