Security 0-days hitting Fedora and Ubuntu open desktops

[e1-531g]

http://arstechnica.com/security/2016...s-now-a-thing/

The exploit ending in .flac works as a drive-by attack when a Fedora 25 user visits a booby-trapped webpage. With nothing more than a click required, the file will open the desktop calculator. With modification, it could load any code an attacker chooses and execute it with the same system privileges afforded to the user. While users typically don't have the same unfettered system privileges granted to root, the ones they do have are plenty powerful. Such an exploit can, for instance, read and steal all the user's most personal data, including documents, pictures, e-mail, and chat transcripts. It could also steal the user's browser cookies and sessions for Gmail, Facebook, Twitter, and other sites. It could additionally persist across reboots, although not as stealthily as a root exploit. And as is growing increasingly common, it could be combined with a local root privilege exploit to gain full system rights. Here's a video of it in action:

Added:
I wasn't able to reproduce this attack on OpenBSD.

chrome(28032) in free(): use after free 0x1fddfd7ab240
Abort trap (core dumped)

But maybe exploit should be just rewritten for OpenBSD.

[scottro]

So, if I am running a minimal desktop such as dwm or openbox, and don't have a desktop calculator installed, is it still vulnerable?

[e1-531g]

Originally Posted by scottro

So, if I am running a minimal desktop such as dwm or openbox, and don't have a desktop calculator installed, is it still vulnerable?

If attacker can run calculator, he probably can run anything (in the context of logged user). Calculator is just an example.

Vulnerability is in Super Nintendo SPC-700 emulator used by gstreamer media playback framework. I don't know whether OpenBSD's antiexploit mitigations can prevent attack on this vulnerability.

Added:
I was trying to figure out whether Game Music Emu is present in ports but I think it is not. gst-inspect also does not know anything about snes or nintendo.

[scottro]

Ah, I see, I didn't read as closely as I should have. Thank you.

[sevendogs]

Good post, thanks OP. Some people think Linux/Unix are not prone to attacks but any OS is. Makes a good case for backing up your data.