| |||||||||||||
|
| |||||||||||||
.desktop files and security.desktop files and securityPosted Apr 7, 2006 14:30 UTC (Fri) by smoogen (subscriber, #97)In reply to: .desktop files and security by kitsilano Parent article: .desktop files and security
Hmmm I dont think the executable bit would be the fix. The .zip attack is the way to get around that. Send the person a .zip file and they extract the stuff from it. Voila, the user pulls out the executable code with the appropriate bits/extensions in it.
Yes it involves the user.. but this attack works 30% of the time from what I can tell from cleaning up windows machines.
(Log in to post comments)
.desktop files and security Posted Apr 8, 2006 23:02 UTC (Sat) by cortana (subscriber, #24596) [Link] When extracting from an untrusted archive, tar, unzip and similar should be invoked with a sane umask that prevents the creation of executable files.
|
|
||||||||||||