Re: .desktop arbitrary program execution (was: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution)

2005-01-20 Thread David Schmitt
On Wednesday 19 January 2005 04:45, David Mandelberg wrote: Attached. Save to your GNOME/KDE desktop (like many newbies do) and double click the new icon. .desktop files (currently) don't need the x bit set to work, so no chmod'ing is necessary. Hmm, attached a screenshot how every MUA

Re: .desktop arbitrary program execution

2005-01-19 Thread David Mandelberg
Rick Moen wrote: Quoting David Mandelberg ([EMAIL PROTECTED]): Attached. Save to your GNOME/KDE desktop (like many newbies do) and double click the new icon. .desktop files (currently) don't need the x bit set to work, so no chmod'ing is necessary. I'm sorry, but the question was:

Re: .desktop arbitrary program execution

2005-01-19 Thread Florian Weimer
* Rick Moen: Please advise this mailing list of which specific Linux or BSD MUA (or specific configuration thereof) is willing to execute a received binary or script attachment. mutt and Gnus are, in typical configurations. Most distributions kindly add all these helpful mailcap entries.

Re: .desktop arbitrary program execution

2005-01-19 Thread Vincent Hanquez
On Wed, Jan 19, 2005 at 12:49:57PM +0100, Florian Weimer wrote: * Rick Moen: Please advise this mailing list of which specific Linux or BSD MUA (or specific configuration thereof) is willing to execute a received binary or script attachment. mutt and Gnus are, in typical

Re: .desktop arbitrary program execution

2005-01-19 Thread Florent Rougon
Florian Weimer [EMAIL PROTECTED] wrote: mutt and Gnus are, in typical configurations. Most distributions kindly add all these helpful mailcap entries. Could you point out a mailcap entry that causes the file to be *executed*? Because running gqview $file.jpg is very different from running

Re: .desktop arbitrary program execution

2005-01-19 Thread Florian Weimer
* Florent Rougon: Florian Weimer [EMAIL PROTECTED] wrote: mutt and Gnus are, in typical configurations. Most distributions kindly add all these helpful mailcap entries. Could you point out a mailcap entry that causes the file to be *executed*? For complex file formats, there is no clear

Re: .desktop arbitrary program execution

2005-01-19 Thread Michael Stone
On Wed, Jan 19, 2005 at 04:29:46PM +0100, Florian Weimer wrote: For complex file formats, there is no clear distinction between opening a file and executing it. Sure there is. For some filetypes execution is an intended effect; that is, you expect arbitrary code to run. For other filetypes there's

Re: .desktop arbitrary program execution

2005-01-19 Thread Rick Moen
Quoting Florian Weimer ([EMAIL PROTECTED]): mutt and Gnus are, in typical configurations. Most distributions kindly add all these helpful mailcap entries. Perhaps you need assistance comprehending the word specific (used twice in my question)? I await with interest your achieving that

Re: .desktop arbitrary program execution

2005-01-19 Thread David Mandelberg
Rick Moen wrote: Quoting David Mandelberg ([EMAIL PROTECTED]): You also asked a question about something I didn't say (I said that the person had to open it). Actually, no, you didn't. (Presumably you intended to, though.) Your question spoke of opening a particularly-named

Re: .desktop arbitrary program execution (was: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution)

2005-01-18 Thread David Mandelberg
Rick Moen wrote: Quoting David Mandelberg ([EMAIL PROTECTED]): Do you mean to say that opening message.txt\t\t\t.desktop which happens to be a freedesktop.org compliant launcher for the program rm -rf $HOME is safe because it's designed for people running one of the F/OSS products GNOME or KDE

Re: .desktop arbitrary program execution (was: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution)

2005-01-18 Thread Rick Moen
Quoting David Mandelberg ([EMAIL PROTECTED]): Attached. Save to your GNOME/KDE desktop (like many newbies do) and double click the new icon. .desktop files (currently) don't need the x bit set to work, so no chmod'ing is necessary. I'm sorry, but the question was: Please advise this

Re: .desktop arbitrary program execution (was: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution)

2005-01-18 Thread Alvin Oga
On Tue, 18 Jan 2005, David Mandelberg wrote: Save to your GNOME/KDE desktop (like many newbies do) and double click the new icon. .desktop files (currently) don't need the x bit set to work, so no chmod'ing is necessary. that'd be dumb of the user This one is pretty harmless (it just