Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-21 Thread Bill Marcum
On Tue, Jan 18, 2005 at 07:14:29PM -0800, Moe wrote: After all these months/years of warnings to NEVER open email attachments, why are you sendinf attachments instead of in-line? Martin Schulze wrote: Part 1 Type: C Encoding: 8bit What mail client are you using,

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-21 Thread David Mandelberg
Adam Lydick wrote: Fantastic idea! (as others have said) Have you filed a bug against nautilus (and other shells) to this effect? You might also file one at the various upstream bug tracking systems as well. I'm glad you like it (I do too), but it wasn't my idea. Search the ubuntu-devel list

Re: .desktop arbitrary program execution (was: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution)

2005-01-20 Thread David Schmitt
On Wednesday 19 January 2005 04:45, David Mandelberg wrote: Attached. Save to your GNOME/KDE desktop (like many newbies do) and double click the new icon. .desktop files (currently) don't need the x bit set to work, so no chmod'ing is necessary. Hmm, attached a screenshot how every MUA

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread Rick Moen
Quoting s. keeling ([EMAIL PROTECTED]): The problem here is the nitwit factor. Yes, well, a bunch of us have been keeping an eye on Linux MUAs and default mailcap behaviour for 10+ years, to make sure zeal for simplicity doesn't lead coders or distro assemblers to do something dumb. Thus my

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread David Mandelberg
s. keeling wrote: No, I assume people have half a brain in their heads, look at the attachment type, maybe save it to a file and inspect it, then maybe look at it or delete it. Too much work? Whether it's too much work or not, most non-geeks I know don't bother. Okay, slap a lot of autoload

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread Florian Weimer
* s. keeling: People who don't use stupid Windows email clients have no trouble with attachments at all. Attachments are a very useful tool; for instance, for code listings, they arrive unmangled by line wrap. Get a better email client, running on a better OS. You mean the OS whose users

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread s. keeling
Incoming from Florian Weimer: * s. keeling: People who don't use stupid Windows email clients have no trouble with attachments at all. Attachments are a very useful tool; for instance, for code listings, they arrive unmangled by line wrap. Get a better email client, running on a

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread Sam Watkins
On Wed, Jan 19, 2005 at 06:52:17AM -0500, David Mandelberg wrote: I'm just suggesting that it should be harder for them to shoot themselves in the foot i.e. by making .desktop's have the x bit before they can be launched. I strongly agree. No, I STRONGLY agree! If they are to be marked

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread Sebastian Lövdahl
Martin Schulze wrote: This message was modified by F-Secure Anti-Virus E-Mail Scanning. This is what F-Secure gave me. Martin do you send viruses? ;) Sebastian -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread Willy Sjonfjell
test tir, 18,.01.2005 kl. 10.41 +0100, skrev Martin Schulze: plain text document-vedlegg -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 644-1 [EMAIL

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread Moe
After all these months/years of warnings to NEVER open email attachments, why are you sendinf attachments instead of in-line? Martin Schulze wrote: Part 1 Type: C Encoding: 8bit -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble?

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread s. keeling
Incoming from Moe: Martin Schulze wrote: Part 1 Type: C Encoding: 8bit After all these months/years of warnings to NEVER open email attachments, why are you sending attachments instead of in-line? People who don't use stupid Windows email clients have no trouble

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread David Mandelberg
s. keeling wrote: Incoming from Moe: Martin Schulze wrote: Part 1 Type: C Encoding: 8bit After all these months/years of warnings to NEVER open email attachments, why are you sending attachments instead of in-line? People who don't use stupid Windows email clients

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread Rick Moen
Quoting David Mandelberg ([EMAIL PROTECTED]): Do you mean to say that opening message.txt\t\t\t.desktop which happens to be a freedesktop.org compliant launcher for the program rm -rf $HOME is safe because it's designed for people running one of the F/OSS products GNOME or KDE on a F/OSS OS?

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread Denis O'Toole
Can you please OT: this Regards Denis O'Toole Moe wrote: After all these months/years of warnings to NEVER open email attachments, why are you sendinf attachments instead of in-line? Martin Schulze wrote: Part 1 Type: C Encoding: 8bit -- To UNSUBSCRIBE, email to

Re: .desktop arbitrary program execution (was: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution)

2005-01-18 Thread David Mandelberg
Rick Moen wrote: Quoting David Mandelberg ([EMAIL PROTECTED]): Do you mean to say that opening message.txt\t\t\t.desktop which happens to be a freedesktop.org compliant launcher for the program rm -rf $HOME is safe because it's designed for people running one of the F/OSS products GNOME or KDE

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread s. keeling
Incoming from David Mandelberg: s. keeling wrote: Incoming from Moe: Martin Schulze wrote: Part 1 Type: C Encoding: 8bit After all these months/years of warnings to NEVER open email attachments, why are you sending attachments instead of in-line? People

Re: .desktop arbitrary program execution (was: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution)

2005-01-18 Thread Rick Moen
Quoting David Mandelberg ([EMAIL PROTECTED]): Attached. Save to your GNOME/KDE desktop (like many newbies do) and double click the new icon. .desktop files (currently) don't need the x bit set to work, so no chmod'ing is necessary. I'm sorry, but the question was: Please advise this

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread s. keeling
Incoming from Rick Moen: Quoting David Mandelberg ([EMAIL PROTECTED]): Do you mean to say that opening message.txt\t\t\t.desktop which happens to be a freedesktop.org compliant launcher for the program rm -rf $HOME is safe because it's designed for people running one of the F/OSS

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread Rick Moen
Quoting s. keeling ([EMAIL PROTECTED]): Well, even mutt will, if you turn on autoload crap in .muttrc and load up your .mailcap with stupid helper apps. Out of the box, no, mutt doesn't do that. Ja. We might call the .mailcap scenario the aim-gun-at-my-foot-please mutt extension. Maybe

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread s. keeling
Incoming from Denis O'Toole: Can you please OT: this Hint: the d key will probably do this for you. Please stop interfering with discussions of insecure applications on debian-security. TVM. :-) -- Any technology distinguishable from magic is insufficiently advanced. (*)

Re: .desktop arbitrary program execution (was: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution)

2005-01-18 Thread Alvin Oga
On Tue, 18 Jan 2005, David Mandelberg wrote: Save to your GNOME/KDE desktop (like many newbies do) and double click the new icon. .desktop files (currently) don't need the x bit set to work, so no chmod'ing is necessary. that'd be dumb of the user This one is pretty harmless (it just

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread s. keeling
Incoming from Rick Moen: Quoting s. keeling ([EMAIL PROTECTED]): Well, even mutt will, if you turn on autoload crap in .muttrc and load up your .mailcap with stupid helper apps. Out of the box, no, mutt doesn't do that. Ja. We might call the .mailcap scenario the