documentation_complete: true

title: 'Disable All GNOME Thumbnailers'

description: |-
    The system's default desktop environment, GNOME, uses
    a number of different thumbnailer programs to generate thumbnails
    for any new or modified content in an opened folder. The following
    command can disable the execution of these thumbnail applications:
    <pre>$ sudo gconftool-2 --direct \
      --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory \
      --type bool \
      --set /desktop/gnome/thumbnailers/disable_all true</pre>
    This effectively prevents an attacker from gaining access to a
    system through a flaw in GNOME's Nautilus thumbnail creators.

rationale: |-
    An attacker with knowledge of a flaw in a GNOME3 thumbnailer application could craft a malicious
    file to exploit this flaw. Assuming the attacker could place the malicious file on the local filesystem
    (via a web upload for example) and assuming a user browses the same location using Nautilus, the
    malicious file would exploit the thumbnailer with the potential for malicious code execution. It
    is best to disable these thumbnailer applications unless they are explicitly required.

severity: unknown

identifiers:
    cce: 27224-5

references:
    nist: CM-7

ocil_clause: 'GNOME thumbnailers are not disabled'

ocil: |-
    These settings can be verified by running the following:
    <pre>$ gconftool-2 -g /desktop/gnome/thumbnailers/disable_all</pre>
    The output should return <tt>true</tt>.
