Skip to content
GitLab
Projects Groups Topics Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in
  • T tails
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
  • Issues 966
    • Issues 966
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 32
    • Merge requests 32
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Artifacts
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • tails
  • tails
  • Issues
  • #14584
Closed
Open
Issue created Sep 01, 2017 by Ghost User@ghost

Backport security fix for Nautilus .desktop file RCE

Originally created by @DonnchaC on #14584 (Redmine)

There is a major security issue with how Nautilus <= 3.22 handlers .desktop launcher shortcuts. Trusted .desktop launchers are able to run arbitrary code when launched. Any .desktop with the executable bit set are treated as trusted by Nautilus.

This opens an attack where an executable .desktop file can be delivered by an attacker in an archive file. After extraction the .desktop file is displayed with an attacker controlled filename and icon. This vulnerability affects Tails users and was demonstrated in a proof-of-concept with SecureDrop users https://github.com/freedomofpress/securedrop/issues/2238

The security issue was fixed in Nautilus 3.24 but it was not backported to previous versions. Micah Lee has opened a backport request at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860268.

I think it is important that this fix be applied for Tails users as soon as possible. I’m happy to help in any way that I can.

Nautilus bug report: https://bugzilla.gnome.org/show_bug.cgi?id=777991
Debian ticket request backport: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860268

Related issues

  • Related to #14793 (closed)
Edited May 15, 2020 by Ghost User
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking