| |||||||||||||
.desktop files and security.desktop files and securityPosted Apr 6, 2006 7:05 UTC (Thu) by kitsilano (subscriber, #14833)In reply to: .desktop files and security by tetromino Parent article: .desktop files and security
I think the executable bit is a simple and unixoid way to solve the problem. You can still use all the flexibility build into the .desktop file. You could even run it from the shell. And any hostile .desktop files sent you by email has to be made executable, like any other executable sent to you. And if the Desktop Environment does not interprete a nonexecutable .desktop file and shows a scary icon, the security will be good enough.
(Log in to post comments)
.desktop files and security Posted Apr 7, 2006 14:30 UTC (Fri) by smoogen (subscriber, #97) [Link] Hmmm I dont think the executable bit would be the fix. The .zip attack is the way to get around that. Send the person a .zip file and they extract the stuff from it. Voila, the user pulls out the executable code with the appropriate bits/extensions in it.
Yes it involves the user.. but this attack works 30% of the time from what I can tell from cleaning up windows machines.
.desktop files and security Posted Apr 8, 2006 23:02 UTC (Sat) by cortana (subscriber, #24596) [Link] When extracting from an untrusted archive, tar, unzip and similar should be invoked with a sane umask that prevents the creation of executable files.
|
|||||||||||||