Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

Not much difference between "open" and "execute"

Posted Jan 30, 2004 19:32 UTC (Fri) by spitzak (guest, #4593)
In reply to: complacency? by hingo
Parent article: Just another Microsoft worm

In reality a script starting with "#!/usr/bin/perl" is really a "perl
document" and you are opening it.

Well, you could make the claim that that counts as an execution. But
eventually you will run into something the user really thinks is a
document. For instance there are plenty of Word viruses around because
Word can run macros, but most users think those are documents. If you
think Linux wont produce a word processor with the same security holes as
Word you have a lot more faith in OSS programmers than I do.

(Log in to post comments)

Posted Jan 31, 2004 20:22 UTC (Sat) by stevenj (guest, #421) [Link]

Of course there will be bugs. There are plenty of them now. The point is that they are recognized as such, and are fixed promptly. The problem is that doing something that seems like opening a file but actually results in the execution of foreign code is not currently considered a design bug.

(Yes, of course executing a file constitutes opening a file, but the reverse is not generally true, or at least it should not be. e.g. the GIF format does not implement a Turing-complete programming language, barring bugs in the viewer.)

Not much difference between "open" and "execute"

Posted Feb 6, 2004 14:20 UTC (Fri) by Wol (guest, #4433) [Link]

WordPerfect beats Word hands down, and the only WordPerfect viruses there are rely on VBA being enabled!

The WordPerfect Macro Language can't be virus-enabled...

Cheers,
Wol