oss-sec mailing list archives
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961)
From: Hanno Böck <hanno () hboeck de>
Date: Wed, 10 Oct 2018 17:04:18 +0200
On Wed, 10 Oct 2018 15:36:52 +0100 Eddie Chapman <eddie () ehuk net> wrote:
But I'm still unclear how "just browsing a website is enough to trigger the vulnerability in some common configurations." Are we talking about the user looking in their web browser cache directory on the filesystem using Nautilus, and hence running malicious code embedded in a cached file via the evince thumbnailer on opening that directory? Or maybe Nautilus/Gnome automatically runs the thumbnailer on every new file created in the user's home directory (via inotify?), including whatever the browser saves in the background (hopefully not)? Or is it just a case of the user opening a downloaded file with evince and becoming a victim that way? Though that is not exactly automatic, most browsers show a prompt asking what to do with a downloaded file.
I don't know what exactly Tavis was referring to, but a scenario that has been discussed in the past and likely is still possible in many configurations is this: Some browsers (notably chrome) will download files without asking in their default configuration. So a site can make you download a file and it ends up in your ~/Downloads dir. Desktop search tools will automatically index that (tracker from gnome, baloo from kde). So voila - you can fire up an exploit if you can exploit anything that tracker or baloo support. https://scarybeastsecurity.blogspot.com/2016/11/0day-poc-risky-design-decisions-in.html Though I'm not sure if either of them uses ghostscript, a quick check it seems that not. You still have the automatic download issue in chrome, but you'd need to convince your user to open up ~/Downloads in a file manager. That's a minor not-fully-automatic part, but I guess it's plausible enough that users will eventually do that at some point. -- Hanno Böck https://hboeck.de/ mail/jabber: hanno () hboeck de GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Current thread:
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961), (continued)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Alex Gaynor (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Doran Moppert (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Perry E. Metzger (Oct 10)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Rich Felker (Oct 16)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Perry E. Metzger (Oct 17)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Rich Felker (Oct 17)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Hanno Böck (Oct 10)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Eddie Chapman (Oct 10)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Hanno Böck (Oct 10)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Emilio Pozuelo Monfort (Oct 11)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Brandon Perry (Oct 10)