CVE-2017-1000083: Command Injection
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
Other sources
Created attachment 1295228 [details] 0001-comics-Remove-support-for-tar-and-tar-like-commands.patch
From the folks at Project Zero:
""" Hi,
The comic book backend in evince 3.24.0 is vulnerable to a command injection bug that can be used to execute arbitrary commands when a cbt file is opened:
cbt files are simple tar archives containing images. When a cbt file is processed, evince calls "tar -xOf $archive $filename" for every image file in the archive:
// backend/comics/comics-document.c: 914 commandline = gstrdupprintf ("%s %s %s", comicsdocument->extractcommand, quotedarchive, quotedfilename);
While both the archive name and the filename are quoted to not be interpreted by the shell, the filename is completely attacker controlled an can start with "--" which leads to tar interpreting it as a command line flag.
This can be exploited by creating a tar archive with an embedded file named [...]
Please credit Felix Wilhelm from the Google Security Team in all releases, patches and advisories related to this issue.
Best, Felix """
All current versions of evince in Fedora and RHEL are vulnerable.
The attached patch will be applied to all versions of Fedora except Fedora 26 and rawhide for which we will use a backport of the comics archive handling rework (https://bugzilla.gnome.org/showbug.cgi?id=720742).
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000083?
CVE-2017-1000083 is rated as high severity due to its ability to allow remote code execution.
How do I fix CVE-2017-1000083?
To fix CVE-2017-1000083, update GNOME Evince to version 3.24.1 or later.
What software is affected by CVE-2017-1000083?
CVE-2017-1000083 affects GNOME Evince versions prior to 3.24.1 and several versions of Debian and Red Hat Enterprise Linux.
Can CVE-2017-1000083 be exploited remotely?
Yes, CVE-2017-1000083 can be exploited remotely through specially crafted .cbt files.
What type of vulnerability is CVE-2017-1000083?
CVE-2017-1000083 is a remote code execution vulnerability that affects GNOME Evince.