Bug 1418632 - Nautilus hides filename for .desktop files with execute permission
Summary: Nautilus hides filename for .desktop files with execute permission
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: nautilus
Version: 7.3
Hardware: All
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Carlos Soriano
QA Contact: Desktop QE
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-02-02 11:49 UTC by Peter
Modified: 2017-02-21 09:17 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-02-21 09:17:29 UTC
Target Upstream Version:


Attachments (Terms of Use)
Screenshot how is possible. (206.61 KB, image/jpeg)
2017-02-02 11:49 UTC, Peter
no flags Details

Description Peter 2017-02-02 11:49:37 UTC
Created attachment 1247064 [details]
Screenshot how is possible.

All Gnome 3 Nautilus versions are affected.

How to reproduce:

1. Create a file called malware.desktop 

2. Add the following content to it:

[Desktop Entry]
Name=CV.pdf
Exec=sh -c 'touch ~/MALWARE_WAS_HERE'
Terminal=false
Icon=x-office-document
Type=Application
Categories=Office

3. Make it executable

Nautilus displays the file like that: (see attachment)

Once the user opens the file the Exec entry is executed without any confirmation. By hiding the filename and therefore also the filename extension users can easily be tricked to execute arbitrary code when some ships files like that in an archive which preserves execute permissions. Especially since nowadays Nautilus even extracts archives with a simple double click.

How to fix it:

Maybe by don't hiding the filename for .desktop files at all.

Comment 2 Carlos Soriano 2017-02-21 09:17:29 UTC
This was fixed upstream and will be present in the next RHEL version.
https://git.gnome.org/browse/nautilus/commit/?id=1630f53481f445ada0a455e9979236d31a8d3bb0


Note You need to log in before you can comment on or make changes to this bug.