Gnome Nautilus [Denial of Service]

vendor:

Nautilus

by:

Panagiotis Vagenas

N/A

CVSS

N/A

Denial of Service

N/A

CWE

Product Name: Nautilus

Affected Version From: 3.16

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu 14.04, Fedora 22

2015

Gnome Nautilus [Denial of Service]

Gnome Nautilus <= v3.16 is vulnerable to DoS attack through a malicious crafted file. A malicious crafted file can be used to perform a DoS attack in Nautilus. The attacker must have local access to affected system or convince the victim to download the file (email, web url etc.). Next time the victim tries to open the directory that contains the malicious file, Nautilus crashes without warning. The file must have a `.jp2` extension and start with the JPEG signature (`0xFFD8`). This seems to happen every time Nautilus is trying to update the thumbnail of the file.

Mitigation:

Upgrade to Nautilus 3.16 or later.

Source

Exploit-DB raw data:

* Exploit Title: Gnome Nautilus [Denial of Service]
* Discovery Date: 2015/10/27
* Public Disclosure Date: 2015/12/01
* Exploit Author: Panagiotis Vagenas
* Contact: https://twitter.com/panVagenas
* Vendor Homepage: https://www.gnome.org/
* Software Link: https://wiki.gnome.org/Apps/Nautilus
* Version: 3.16
* Tested on: Ubuntu 14.04, Fedora 22


Description
========================================================================
========

Gnome Nautilus <= v3.16 is vulnerable to DoS attack through a
malicious crafted file.

Details
- ------------------------------------------------------------------------
- --------
A malicious crafted file can be used to perform a DoS attack in
Nautilus. The attacker must have local
access to affected system or convince the victim to download the file
(email, web url etc.). Next time
the victim tries to open the directory that contains the malicious
file, Nautilus crashes without warning.

The file must have a `.jp2` extension and start with the JPEG
signature (`0xFFD8`).

Additional Notes
- ------------------------------------------------------------------------
- --------

This seems to happen every time Nautilus is trying to update the
thumbnail of the file.

In Ubuntu and Fedora process dies with the message:
```
Premature end of JPEG file
JPEG datastream contains no image
```

This vulnerability seems to affect all Nautilus versions prior to 3.16.

PoC
========================================================================
========

1. Create a file without a `.jp2` extension in an affected system
2. Open the file in a hex editor so it start with the JPEG signature
(`0xFFD8`)
3. Rename the file so it has the `.jp2` extension
4. Open directory with Nautilus
5. Nautilus dies without warning

Timeline
========================================================================
========

2015/10/27 - Discovered
2015/10/29 - Vendor notified at security@gnome.org

Solution
========================================================================
========

No official solution yet exists.

Work-around
- ------------------------------------------------------------------------
- --------

Disabling generation of thumbnails for all files, through Nautilus
options, will prevent Nautilus from crashing.