CVE-2017-1000083

What it actually does

The comic book backend in Evince processes .cbt TAR archives by passing filenames directly to command-line tools without sanitization, allowing filenames beginning with '--' to inject arbitrary options and commands such as --checkpoint-action=exec=...

Why it matters to the business

Users who open malicious comic files can have arbitrary commands executed with their privileges, resulting in full system compromise, data theft, or ransomware deployment; the vulnerability has been weaponized for years and remains relevant wherever older Evince packages are still deployed.

How an attack unfolds

An attacker crafts a TAR archive whose member filename starts with a double-dash command-line option (for example --checkpoint-action=exec=bash), packages it as a .cbt file, and delivers it via email or web download; when the victim opens the file, Evince's comics backend invokes the tar utility with the malicious filename, causing the injected command to run.

How to fix it

Upgrade gnome/evince to the commit 717df38fd8509bf883b70d680c9b1b3cf36732ee or any later release that contains the fix; remove or restrict use of the comic-book backend if patching is not feasible.

How to confirm the fix worked

Confirm Evince version is at or above the fixed commit; attempt to open a test .cbt file containing a filename that begins with '--help' and verify that no extraneous output or command execution occurs; review package changelogs for the backend/comics/comics-document.c patch.

Typical attack path

1. Create TAR archive containing a member whose name begins with '--' followed by a command option
2. Rename archive with .cbt extension
3. Deliver file to target via phishing, download site, or shared storage
4. Victim opens the file in Evince
5. Backend invokes tar with the crafted filename, executing attacker-controlled commands

How to detect it

Search endpoint process-creation logs for evince spawning child processes that contain command-line flags beginning with '--checkpoint' or '--exec'; inspect downloaded or opened files whose names end in .cbt and contain TAR member names starting with '--'; review shell history and audit logs for unexpected commands executed around the time a .cbt file was accessed.

• evince.*--checkpoint-action
• .cbt.*--exec=
• tar.*--checkpoint-action=exec

What your security team should do

• Immediately upgrade all Evince installations to the fixed commit or newer packaged release
• Block or sandbox opening of .cbt files from untrusted sources until updates are applied
• Hunt for historical indicators of .cbt files with leading '--' in filenames on endpoints that still run vulnerable Evince versions
• Add Evince to the organization's priority patching list given the weaponized exploit maturity