PT-2013-01: XML External Entity Injection in GNOME

Vulnerable software

GNOME
Version 3.8.1 and earlier

Application link:
http://www.gnome.org

Severity level

Severity level: Medium
Impact: Internal Network Resources Access, File System Access
Access Vector: Local  

CVSS v2: 
Base Score: 6.6 
Vector: (AV:L/AC:L/Au:N/C:C/I:N/A:C)

CVE: N/A

Software description

GNOME is a desktop environment and graphical user interface that runs on top of a computer operating system.

Vulnerability description

Positive Research Center experts have detected a local resources access vulnerability (files and internal network resources) via  XML External Entity enabled in GNOME.

An attacker is able to give a user a specially crafted file. If he or she views a folder with the file or opens it, librsvg sends local resource's contents  to the attacker's server.

How to fix

Update your software up to the latest version.

Advisory status

14.01.2013 - Vendor gets vulnerability details
16.05.2013 - Vendor releases fixed version and details
20.06.2013 - Public disclosure

Credits

This vulnerability have discovered by Timur Yunusov and Alexey Osipov, Positive Research Center (Positive Technologies Company)

References

http://en.securitylab.ru/lab/PT-2013-01

Reports on the vulnerabilities previously discovered by Positive Research:

http://ptsecurity.com/research/advisory/
http://en.securitylab.ru/lab/