Executive Summary

This vulnerability exists in the nano text editor when used in environments with permissive umask settings. Specifically, the ~/.local directory is created with overly permissive permissions (0777) instead of more restrictive ones (0700). Because of this, a local attacker can place a malicious .desktop launcher file into this directory. If the launcher is later processed by the system, it could trigger unintended actions or lead to information disclosure.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is limited but notable. A local attacker with access to the affected system can exploit the incorrect directory permissions to inject a malicious .desktop launcher. This could cause unintended actions to be executed or sensitive information to be disclosed if the launcher is processed. However, the overall severity is low, as indicated by the CVSS score of 2.5, and it requires local access and high attack complexity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the permissions of the ~/.local directory on affected systems. Specifically, look for overly permissive permissions set to 0777 instead of the recommended 0700.

• Run the command: ls -ld ~/.local
• If the output shows permissions as drwxrwxrwx (0777), the system is vulnerable.
• Additionally, inspect the ~/.local directory for any suspicious or unexpected .desktop launcher files that could have been injected by an attacker.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately correct the permissions of the ~/.local directory to restrict access.

• Run the command: chmod 700 ~/.local
• Review and remove any suspicious .desktop launcher files within the ~/.local directory.
• Ensure that the system's umask settings are configured to prevent overly permissive directory permissions in the future.

Useful 0 Not Useful 0