[20260] in bugtraq
Re: Double clicking on innocent looking files may be dangerous
daemon@ATHENA.MIT.EDU (Riddoch, John ESSI-ISEP-3)
Tue Apr 17 13:12:18 2001
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Message-ID: <C19D2288420DD31197B50008C70D8DC301D0AFCC@abes9999.is.shell.co.uk>
Date: Tue, 17 Apr 2001 11:31:15 +0200
Reply-To: "Riddoch, John ESSI-ISEP-3" <John.E.Riddoch@IS.SHELL.COM>
From: "Riddoch, John ESSI-ISEP-3" <John.E.Riddoch@IS.SHELL.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
> I shall skip the oft-mentioned rant on the subject
> of running
> unknown and unexpected files of strange types from unknown
> and untrusted
> sources ;-)
I think the issue here is that even when the sensible user has disabled
"hide extensions" he should be safe to assume that a .txt file is only text
and is, therefore, safe to open. In short, it doesn't appear to be a file
of "strange type".
The fact that the description shows "HTML application" is only relevant
where the user is browsing using "View/Details"; using small or large icons
will only show a .txt file, although the icon may be a giveaway that
something is up.
FWIW, it shows the same behaviour here on an NT 4.0 SP5 machine.
