Bug 1491425

+++ This bug was initially created as a clone of Bug #1442231 +++

Description of problem:

There is a bug in Nautilus that makes it possible to disguise a malicious script as an innocent document, like a PDF or ODT, that gets executed when the user opens it.

The upstream nautilus issue [1] has already been resolved, and will be released in nautilus 3.24. But since this is an important security issue, I think this patch should be backported so that it's fixed in older versions of Fedora.

See this blog post [2] for more about how this bug allows attackers to compromise Subgraph OS. Fedora is vulnerable to the same type of attack.

[1] https://bugzilla.gnome.org/show_bug.cgi?id=777991
[2] https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os/


Steps to Reproduce:

Make a file called malware.desktop that has this content:

[Desktop Entry]
Encoding=UTF-8
Name=resume.odt
Exec=gnome-calculator
Terminal=false
Type=Application
Icon=libreoffice-writer.png

Now make malware.desktop executable (chmod 755 malware.desktop). If you open nautilus and browse to the folder that this document is in, it looks like there's a LibreOffice document called "resume.odt". But when you double-click on it, it runs the attackers code. In this case, it opens the calculator.

--- Additional comment from Jan Kurik on 2017-08-15 02:55:11 EDT ---

This bug appears to have been reported against 'rawhide' during the Fedora 27 development cycle.
Changing version to '27'.