But like any other operating system, Linux also has vulnerabilities. The most recent one affects most distributions and requires only one music file to be exploited. Linux has been experiencing serious vulnerabilities in the recent past and that jeopardize the security of its users’ systems and data. They result from failures that take years to discover and are now emerging. The latest flaw was discovered by Chris Evans, a security researcher and is known to affect almost all of the distributions that are available for installation, including newer ones such as Fedora 25 or Ubuntu 16.04 LTS.
The security researcher Chris Evans disclosed the two zero-days affecting Gstreamer, an application which is actually responsible for indexing and generating thumbnails and previews for files in various Linux desktop environments. Evan says “that an attacker can host a malicious audio file online that when the user downloads on his computer, will automatically be indexed by Gstreamer”. According to what is described, the fault is in the audio library, the music game Emu allowing emulation of audio consoles such as the SNES. When it exploited, a file with malicious code suffices, then the attacker manages to run any code that he/she wants, exposing the system and the data of the user.
Further, to complicate the matters, in order to be able to exploit the fault, only Chrome is required so that attacker can easily make the system vulnerable. To propagate this malicious file, simply change the name to .flac or .mp3 and make it available for download. Once it is executed the malicious code goes into action and depends only on the attacker. The flaw is identified by Chris Evans and results in the lack of security with which this type of file is handled. Contrary to what is normal do not run inside a sandbox to be isolated from the system. However, an update will soon be released that will resolve this serious flaw. This is not just a theoretical proof of a failure that can be exploited. It is real and can easily be used to attack these systems. With this failure, we got another proof that there are no such systems available which are totally secure or un-hackable.
