Re: ghostscript: bypassing executeonly to escape -dSAFER sandbox (CVE-2018-17961)

[Brandon Perry <bperry.volatile () gmail com>]

On Wed, 2018-10-10 at 15:36 +0100, Eddie Chapman wrote:
> On 10/10/18 13:53, Hanno Böck wrote:
> > On Wed, 10 Oct 2018 10:10:58 +0100
> > Eddie Chapman <eddie () ehuk net> wrote:
> >
> > > While the vulnerability in ghostscript itself is clear in this
> > > thread, does anyone have any more info on the above aspect of
> > > this?
> > > i.e is the above scenario (inadvertently running postscript,
> > > perhaps
> > > contained in an image, through ghostscript by just browsing a
> > > malicious site) limited to just nautilus in gnome environments?
> > > Do
> > > other browsers/environments handle this better or do they do
> > > similar?
> > > It seems that, strictly speaking, the "critical" nature of this
> > > vulnerability hinges on the behaviour of the browser/desktop
> > > environment. Otherwise the scope is limited to an individual
> > > manually
> > > downloading a postscript file and opening it outside of the
> > > browser.
> >
> > evince installs a thumbnail entry to
> > /usr/share/thumbnailers
> >
> > This is a generic location where applications can install files (I
> > believe they follow the .desktop specification, which is an ini-
> > based
> > format). This is thus not nautilus-specific, but every filemanager
> > that
> > uses this format will be affected. A quick googling tells me e.g.
> > pcmanfm is also affected. I'm not sure if dolphin uses them as
> > well.
> >
> > Nautilus is trying to solve this by sandboxing the thumbnailers.
> > However this depends on bubblewrap and is currently fail-open, i.e.
> > if
> > bubblewrap is not available it will not disable the thumbnailing,
> > it
> > will just not sandbox it. In practice this means it's often not
> > sandboxed. I doubt this will change any time soon.
> >
> > Very similar problems show up with desktop search tools.
> >
> > I think this whole concept is questionable and should be reviewed.
> > I
> > think it's not desirable to have thumbnailers for all kinds of
> > formats,
> > instead a more reasonable approach would be to limit thumbnailing
> > to a
> > few widely used formats that have well-reviewed libraries (e.g. I
> > don't
> > think that libjpeg or libpng will have any vulnerabilities left
> > that are
> > even remotely as severe as the things tavis found in ghostscript).
>
> Ah OK, I got confused (having not used gnome or nautilus for a long 
> time) of what exactly Nautilus' role is here. Because Tavis
> mentioned 
> web browsing and nautilus together in my mind I was thinking
> nautilus 
> was the web browser here forgot it's a file manager :-)
>
> But I'm still unclear how "just browsing a website is enough to
> trigger 
> the vulnerability in some common configurations." Are we talking
> about 
> the user looking in their web browser cache directory on the
> filesystem 
> using Nautilus, and hence running malicious code embedded in a
> cached 
> file via the evince thumbnailer on opening that directory? Or maybe 
> Nautilus/Gnome automatically runs the thumbnailer on every new file 
> created in the user's home directory (via inotify?), including
> whatever 
> the browser saves in the background (hopefully not)? Or is it just a 
> case of the user opening a downloaded file with evince and becoming
> a 
> victim that way? Though that is not exactly automatic, most browsers 
> show a prompt asking what to do with a downloaded file.

A whole ago, there was a vuln in Evince in how it handled comic book
files.

https://vuldb.com/?id.106116

By default, nautilus renders a thumbnail of media if it is possible,
and evince can render a thumbnail of the first image in the comic book
simply by browsing to the Downloads directory.

If a malicious comic book were downloaded but not opened, then I opened
my Downloads directory, rendering the comic book thumbnail would cause
the payload to be executed in the context of the user opening Nautilus.

This same technique would apply here since Nautilus can use ghostscript
to render a thumbnail preview of a PS file.

> So, still slightly confused, how one can become a victim here just 
> browsing a website. It's probably obvious to everyone but I'm not 
> getting it having always run a quite minimal desktop for years 
> (currently a mixture of Awesome window manager + some Mate elements, 
> caja file manager) .... Or maybe no-one wants to spell it out so as
> not 
> to give the bad guys any free tips. So feel free to ignore me if
> it's 
> either of those :-)