PT-2017-13575 · Gnome+4 · Gnome Nautilus+4

Micah Lee · Published 2017-03-25 · Updated 2020-08-18 · CVE-2017-14604

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GNOME Nautilus versions prior to 3.23.90

Description The issue allows attackers to spoof a file type by using the .desktop file extension. This can be demonstrated by an attack where a .desktop file's Name field ends in .pdf, but the Exec field launches a malicious "sh -c" command. The UI does not indicate that a file has the potentially unsafe .desktop extension; instead, it only shows the .pdf extension. An attack requires the .desktop file to have execute permission.

Recommendations For versions prior to 3.23.90, the solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field. As a temporary workaround, consider restricting the execution of .desktop files to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2017-1345

CESA-2018_0223

CVE-2017-14604

DSA-3994-1

OPENSUSE-SU-2018_2210-1

RHSA-2018:0223

RHSA-2018_0223

SUSE-SU-2018:1694-1

SUSE-SU-2018:2058-1

SUSE-SU-2018_1694-1

SUSE-SU-2018_2058-1

Affected Products

Alt Linux

Centos

Gnome Nautilus

Red Hat

Suse

References · 24

• 🔥 https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os · Exploit
• https://github.com/GNOME/nautilus/commit/1630f53481f445ada0a455e9979236d31a8d3bb0 · Patch
• https://github.com/GNOME/nautilus/commit/bc919205bf774f6af3fa7154506c46039af5a69b · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-14604 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3994-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14604 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-14604 · Security Note
• http://debian.org/security/2017/dsa-3994 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14604 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:1694-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14604 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14604 · Vendor Advisory
• https://bugzilla.gnome.org/show_bug.cgi?id=777991 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2018-0223.html · Vendor Advisory