GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.

The remote NewStart CGSL host, running version MAIN 5.04, has nautilus packages installed that are affected by a vulnerability:

  - An untrusted .desktop file with executable permission     set could choose its displayed name and icon, and     execute commands without warning when opened by the     user. An attacker could use this flaw to trick a user     into opening a .desktop file disguised as a document,     such as a PDF, and execute arbitrary commands.
    (CVE-2017-14604)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for nautilus fixes the following issues :

Security issue fixed :

  - CVE-2017-14604: Add a metadata::trusted metadata to the     file once the user acknowledges the file as trusted, and     also remove the 'trusted' content in the desktop file     (bsc#1060031).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for nautilus fixes the following issues: Security issue fixed :

  - CVE-2017-14604: Add a metadata::trusted metadata to the     file once the user acknowledges the file as trusted, and     also remove the 'trusted' content in the desktop file     (bsc#1060031).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nautilus fixes the following security issue :

  - CVE-2017-14604: Fixed a file type spoofing attack by     adding a metadata::trusted attribute to a file once the     user acknowledges the file as trusted, and also remove     the 'trusted' content in the desktop file (bsc#1060031).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Insufficient validation of trust of .desktop files with execute permission

An untrusted .desktop file with executable permission set could choose its displayed name and icon, and execute commands without warning when opened by the user. An attacker could use this flaw to trick a user into opening a .desktop file disguised as a document, such as a PDF, and execute arbitrary commands.(CVE-2017-14604)

According to the version of the nautilus packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An untrusted .desktop file with executable permission     set could choose its displayed name and icon, and     execute commands without warning when opened by the     user. An attacker could use this flaw to trick a user     into opening a .desktop file disguised as a document,     such as a PDF, and execute arbitrary commands.
    (CVE-2017-14604)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2018:0223 :

An update for nautilus is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Nautilus is the file manager and graphical shell for the GNOME desktop.

Security Fix(es) :

* An untrusted .desktop file with executable permission set could choose its displayed name and icon, and execute commands without warning when opened by the user. An attacker could use this flaw to trick a user into opening a .desktop file disguised as a document, such as a PDF, and execute arbitrary commands. (CVE-2017-14604)

Note: This update will change the behavior of Nautilus. Nautilus will now prompt the user for confirmation when executing an untrusted .desktop file for the first time, and then add it to the trusted file list. Desktop files stored in the system directory, as specified by the XDG_DATA_DIRS environment variable, are always considered trusted and executed without prompt.

An update for nautilus is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Nautilus is the file manager and graphical shell for the GNOME desktop.

Security Fix(es) :

* An untrusted .desktop file with executable permission set could choose its displayed name and icon, and execute commands without warning when opened by the user. An attacker could use this flaw to trick a user into opening a .desktop file disguised as a document, such as a PDF, and execute arbitrary commands. (CVE-2017-14604)

Note: This update will change the behavior of Nautilus. Nautilus will now prompt the user for confirmation when executing an untrusted .desktop file for the first time, and then add it to the trusted file list. Desktop files stored in the system directory, as specified by the XDG_DATA_DIRS environment variable, are always considered trusted and executed without prompt.

Security Fix(es) :

  - An untrusted .desktop file with executable permission     set could choose its displayed name and icon, and     execute commands without warning when opened by the     user. An attacker could use this flaw to trick a user     into opening a .desktop file disguised as a document,     such as a PDF, and execute arbitrary commands.
    (CVE-2017-14604)

Note: This update will change the behavior of Nautilus. Nautilus will now prompt the user for confirmation when executing an untrusted .desktop file for the first time, and then add it to the trusted file list. Desktop files stored in the system directory, as specified by the XDG_DATA_DIRS environment variable, are always considered trusted and executed without prompt.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0223 advisory.

  - nautilus: Insufficient validation of trust of .desktop files with execute permission (CVE-2017-14604)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Christian Boxdorfer discovered a vulnerability in the handling of FreeDesktop.org .desktop files in Nautilus, a file manager for the GNOME desktop environment. An attacker can craft a .desktop file intended to run malicious commands but displayed as a innocuous document file in Nautilus. An user would then trust it and open the file, and Nautilus would in turn execute the malicious content.
Nautilus protection of only trusting .desktop files with executable permission can be bypassed by shipping the .desktop file inside a tarball.

ID	Name	Product	Family	Severity
127167	NewStart CGSL MAIN 5.04 : nautilus Vulnerability (NS-SA-2019-0015)	Nessus	NewStart CGSL Local Security Checks	medium
111564	openSUSE Security Update : nautilus (openSUSE-2018-802)	Nessus	SuSE Local Security Checks	medium
111347	SUSE SLED12 / SLES12 Security Update : nautilus (SUSE-SU-2018:2058-1)	Nessus	SuSE Local Security Checks	medium
110547	SUSE SLES11 Security Update : nautilus (SUSE-SU-2018:1694-1)	Nessus	SuSE Local Security Checks	medium
109128	Amazon Linux 2 : nautilus (ALAS-2018-960)	Nessus	Amazon Linux Local Security Checks	medium
108457	EulerOS 2.0 SP1 : nautilus (EulerOS-SA-2018-1053)	Nessus	Huawei Local Security Checks	medium
106762	EulerOS 2.0 SP2 : nautilus (EulerOS-SA-2018-1034)	Nessus	Huawei Local Security Checks	medium
106368	Oracle Linux 7 : nautilus (ELSA-2018-0223)	Nessus	Oracle Linux Local Security Checks	medium
106356	CentOS 7 : nautilus (CESA-2018:0223)	Nessus	CentOS Local Security Checks	medium
106341	Scientific Linux Security Update : nautilus on SL7.x x86_64 (20180125)	Nessus	Scientific Linux Local Security Checks	medium
106336	RHEL 7 : nautilus (RHSA-2018:0223)	Nessus	Red Hat Local Security Checks	medium
103717	Debian DSA-3994-1 : nautilus - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2017-14604

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium