oss-sec mailing list archives
Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961)
From: Hanno Böck <hanno () hboeck de>
Date: Wed, 10 Oct 2018 14:53:30 +0200
On Wed, 10 Oct 2018 10:10:58 +0100 Eddie Chapman <eddie () ehuk net> wrote:
While the vulnerability in ghostscript itself is clear in this thread, does anyone have any more info on the above aspect of this? i.e is the above scenario (inadvertently running postscript, perhaps contained in an image, through ghostscript by just browsing a malicious site) limited to just nautilus in gnome environments? Do other browsers/environments handle this better or do they do similar? It seems that, strictly speaking, the "critical" nature of this vulnerability hinges on the behaviour of the browser/desktop environment. Otherwise the scope is limited to an individual manually downloading a postscript file and opening it outside of the browser.
evince installs a thumbnail entry to /usr/share/thumbnailers This is a generic location where applications can install files (I believe they follow the .desktop specification, which is an ini-based format). This is thus not nautilus-specific, but every filemanager that uses this format will be affected. A quick googling tells me e.g. pcmanfm is also affected. I'm not sure if dolphin uses them as well. Nautilus is trying to solve this by sandboxing the thumbnailers. However this depends on bubblewrap and is currently fail-open, i.e. if bubblewrap is not available it will not disable the thumbnailing, it will just not sandbox it. In practice this means it's often not sandboxed. I doubt this will change any time soon. Very similar problems show up with desktop search tools. I think this whole concept is questionable and should be reviewed. I think it's not desirable to have thumbnailers for all kinds of formats, instead a more reasonable approach would be to limit thumbnailing to a few widely used formats that have well-reviewed libraries (e.g. I don't think that libjpeg or libpng will have any vulnerabilities left that are even remotely as severe as the things tavis found in ghostscript). -- Hanno Böck https://hboeck.de/ mail/jabber: hanno () hboeck de GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Current thread:
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961), (continued)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Perry E. Metzger (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Tavis Ormandy (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Alex Gaynor (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Doran Moppert (Oct 09)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Perry E. Metzger (Oct 10)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Rich Felker (Oct 16)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Perry E. Metzger (Oct 17)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Rich Felker (Oct 17)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Hanno Böck (Oct 10)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Eddie Chapman (Oct 10)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Hanno Böck (Oct 10)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Emilio Pozuelo Monfort (Oct 11)
- Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961) Brandon Perry (Oct 10)