Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961)

[Emilio Pozuelo Monfort <pochu27 () gmail com>]

On 10/10/2018 17:04, Hanno Böck wrote:
> On Wed, 10 Oct 2018 15:36:52 +0100
> Eddie Chapman <eddie () ehuk net> wrote:
>
> > But I'm still unclear how "just browsing a website is enough to
> > trigger the vulnerability in some common configurations." Are we
> > talking about the user looking in their web browser cache directory
> > on the filesystem using Nautilus, and hence running malicious code
> > embedded in a cached file via the evince thumbnailer on opening that
> > directory? Or maybe Nautilus/Gnome automatically runs the thumbnailer
> > on every new file created in the user's home directory (via
> > inotify?), including whatever the browser saves in the background
> > (hopefully not)? Or is it just a case of the user opening a
> > downloaded file with evince and becoming a victim that way? Though
> > that is not exactly automatic, most browsers show a prompt asking
> > what to do with a downloaded file.
>
> I don't know what exactly Tavis was referring to, but a scenario that
> has been discussed in the past and likely is still possible in many
> configurations is this:
> Some browsers (notably chrome) will download files without asking in
> their default configuration. So a site can make you download a file and
> it ends up in your ~/Downloads dir.
>
> Desktop search tools will automatically index that (tracker from gnome,
> baloo from kde). So voila - you can fire up an exploit if you can
> exploit anything that tracker or baloo support.

tracker-extract / miners run in a sandbox these days. No idea about baloo.

https://bugzilla.gnome.org/show_bug.cgi?id=764786

Cheers,
Emilio

> https://scarybeastsecurity.blogspot.com/2016/11/0day-poc-risky-design-decisions-in.html
>
> Though I'm not sure if either of them uses ghostscript, a quick check
> it seems that not. You still have the automatic download issue in
> chrome, but you'd need to convince your user to open up ~/Downloads in
> a file manager. That's a minor not-fully-automatic part, but I guess
> it's plausible enough that users will eventually do that at some point.