[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 11 Oct 2018 10:42:54 +0200
From: Emilio Pozuelo Monfort <pochu27@...il.com>
To: oss-security@...ts.openwall.com, Hanno Böck
<hanno@...eck.de>, Eddie Chapman <eddie@...k.net>
Subject: Re: ghostscript: bypassing executeonly to escape
-dSAFER sandbox (CVE-2018-17961)
On 10/10/2018 17:04, Hanno Böck wrote:
> On Wed, 10 Oct 2018 15:36:52 +0100
> Eddie Chapman <eddie@...k.net> wrote:
>
>> But I'm still unclear how "just browsing a website is enough to
>> trigger the vulnerability in some common configurations." Are we
>> talking about the user looking in their web browser cache directory
>> on the filesystem using Nautilus, and hence running malicious code
>> embedded in a cached file via the evince thumbnailer on opening that
>> directory? Or maybe Nautilus/Gnome automatically runs the thumbnailer
>> on every new file created in the user's home directory (via
>> inotify?), including whatever the browser saves in the background
>> (hopefully not)? Or is it just a case of the user opening a
>> downloaded file with evince and becoming a victim that way? Though
>> that is not exactly automatic, most browsers show a prompt asking
>> what to do with a downloaded file.
>
> I don't know what exactly Tavis was referring to, but a scenario that
> has been discussed in the past and likely is still possible in many
> configurations is this:
> Some browsers (notably chrome) will download files without asking in
> their default configuration. So a site can make you download a file and
> it ends up in your ~/Downloads dir.
>
> Desktop search tools will automatically index that (tracker from gnome,
> baloo from kde). So voila - you can fire up an exploit if you can
> exploit anything that tracker or baloo support.
tracker-extract / miners run in a sandbox these days. No idea about baloo.
https://bugzilla.gnome.org/show_bug.cgi?id=764786
Cheers,
Emilio
> https://scarybeastsecurity.blogspot.com/2016/11/0day-poc-risky-design-decisions-in.html
>
> Though I'm not sure if either of them uses ghostscript, a quick check
> it seems that not. You still have the automatic download issue in
> chrome, but you'd need to convince your user to open up ~/Downloads in
> a file manager. That's a minor not-fully-automatic part, but I guess
> it's plausible enough that users will eventually do that at some point.
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
