CVE-2017-14604
published 2017-09-20CVE-2017-14604: GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop…
PriorityP333medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
2.47%
82.9th percentile
GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | nautilus | < nautilus 3.25.90-1 (bookworm) | nautilus 3.25.90-1 (bookworm) |
| gnome | nautilus | < 3.23.90 | 3.23.90 |
| gnome | nautilus | >= 0 < 3.25.90-1 | 3.25.90-1 |
| gnome | nautilus | >= 0 < 3.25.90-1 | 3.25.90-1 |
| gnome | nautilus | >= 0 < 3.25.90-1 | 3.25.90-1 |
| gnome | nautilus | >= 0 < 3.25.90-1 | 3.25.90-1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-94j8-ww24-pr2v: GNOME Nautilus before 3
ghsa_unreviewed·2022-05-13
CVE-2017-14604 [MEDIUM] CWE-20 GHSA-94j8-ww24-pr2v: GNOME Nautilus before 3
GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.
OSV
CVE-2017-14604: GNOME Nautilus before 3
osv·2017-09-20·CVSS 6.5
CVE-2017-14604 [MEDIUM] CVE-2017-14604: GNOME Nautilus before 3
GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.
Red Hat
nautilus: Insufficient validation of trust of .desktop files with execute permission
vendor_redhat·2017-01-31·CVSS 6.5
CVE-2017-14604 [MEDIUM] CWE-345 nautilus: Insufficient validation of trust of .desktop files with execute permission
nautilus: Insufficient validation of trust of .desktop files with execute permission
GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.
An untrusted .deskt
Debian
CVE-2017-14604: nautilus - GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the...
vendor_debian·2017·CVSS 6.5
CVE-2017-14604 [MEDIUM] CVE-2017-14604: nautilus - GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the...
GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.
Scope: local
bookworm: resolved (fixed in 3.25.90-1)
bullseye: resolved (fixed in 3.25.90-1)
forky: resolv
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-14604 nautilus: Insufficient validation of trust of .desktop files with execute permission
bugzilla·2017-09-12·CVSS 6.5
CVE-2017-14604 [MEDIUM] CVE-2017-14604 nautilus: Insufficient validation of trust of .desktop files with execute permission
CVE-2017-14604 nautilus: Insufficient validation of trust of .desktop files with execute permission
Nautilus trusts desktop files that have the executable bit set, and doesn't replace the displayed icon or the displayed name until it's trusted, which prevents from running random programs by a malicious desktop file.
However, the executable permission is preserved if the desktop file comes from a compressed file. A maliciously crafted file opened by the user could result in code execution.
Upstream issue:
https://bugzilla.gnome.org/show_bug.cgi?id=777991
Upstream patch:
https://bugzilla.gnome.org/attachment.cgi?id=345047&action=diff
Discussion:
Created nautilus tracking bugs for this issue:
Affects: fedora-25 [bug 1490873]
---
This issue has been addressed in the following produc
Bugzilla
CVE-2017-14604 nautilus: nautilus: Insufficient validation of trust of .desktop files with execute permission [fedora-25]
bugzilla·2017-09-12·CVSS 6.5
CVE-2017-14604 [MEDIUM] CVE-2017-14604 nautilus: nautilus: Insufficient validation of trust of .desktop files with execute permission [fedora-25]
CVE-2017-14604 nautilus: nautilus: Insufficient validation of trust of .desktop files with execute permission [fedora-25]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-25.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussi
http://www.debian.org/security/2017/dsa-3994http://www.securityfocus.com/bid/101012https://access.redhat.com/errata/RHSA-2018:0223https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860268https://bugzilla.gnome.org/show_bug.cgi?id=777991https://github.com/GNOME/nautilus/commit/1630f53481f445ada0a455e9979236d31a8d3bb0https://github.com/GNOME/nautilus/commit/bc919205bf774f6af3fa7154506c46039af5a69bhttps://github.com/freedomofpress/securedrop/issues/2238https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os/http://www.debian.org/security/2017/dsa-3994http://www.securityfocus.com/bid/101012https://access.redhat.com/errata/RHSA-2018:0223https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860268https://bugzilla.gnome.org/show_bug.cgi?id=777991https://github.com/GNOME/nautilus/commit/1630f53481f445ada0a455e9979236d31a8d3bb0https://github.com/GNOME/nautilus/commit/bc919205bf774f6af3fa7154506c46039af5a69bhttps://github.com/freedomofpress/securedrop/issues/2238https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os/
2017-09-20
Published