Sie suchen Geschäftskontakte in Europa? Wir stellen diese Kontakte für Sie her!

2005-01-19 Thread Agentur España
Title: Sie suchen Geschäftskontakte in Europa? Wir stellen diese Kontakte für Sie her!   Guten Tag, debian-security@lists.debian.org   Donnerstag, 20. Januar 2005 Unsere Werbeagentur möchte Sie

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread Sam Watkins
On Wed, Jan 19, 2005 at 06:52:17AM -0500, David Mandelberg wrote: > I'm just suggesting that it should be harder for them to shoot > themselves in the foot i.e. by making .desktop's have the x bit before > they can be launched. I strongly agree. No, I STRONGLY agree! If they are to be marked exe

Re: [meta] Set reply-to to something else?

2005-01-19 Thread Robert Brockway
On Wed, 19 Jan 2005, Vassilii Khachaturov wrote: > I hope that I am not the only one who writes to the auto-ackers and > their postmasters that they're using stupid MUAs not honoring > Precedence: bulk > or > Precedence: junk > as well as the other list-control fields as a flags to not auto-respon

Re: [SECURITY] [DSA 643-1] New queue packages fix buffer overflows

2005-01-19 Thread Joey Hess
Martin Schulze wrote: > For the unstable distribution (sid) these problems have been fixed in > version 1.30.1-5. A day later and unstable still has 1.30.1-4.2 and I see no 1.30.1-5 in incoming. Did the upload go missing? -- see shy jo signature.asc Description: Digital signature

Re: .desktop arbitrary program execution

2005-01-19 Thread David Mandelberg
Rick Moen wrote: > Quoting David Mandelberg ([EMAIL PROTECTED]): > > >>You also asked a question about something I didn't say (I said that >>the person had to open it). > > > Actually, no, you didn't. (Presumably you intended to, though.) > > Your question spoke of "opening" a particularly-na

unsubscribe

2005-01-19 Thread michael . english

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread s. keeling
Incoming from Florian Weimer: > * s. keeling: > > > People who don't use stupid Windows email clients have no trouble with > > attachments at all. Attachments are a very useful tool; for instance, > > for code listings, they arrive unmangled by line wrap. > > > > Get a better email client, runnin

Re: .desktop arbitrary program execution

2005-01-19 Thread Rick Moen
Quoting David Mandelberg ([EMAIL PROTECTED]): > You also asked a question about something I didn't say (I said that > the person had to open it). Actually, no, you didn't. (Presumably you intended to, though.) Your question spoke of "opening" a particularly-named attachment: You left unstated

Re: .desktop arbitrary program execution

2005-01-19 Thread Rick Moen
Quoting Florian Weimer ([EMAIL PROTECTED]): > mutt and Gnus are, in typical configurations. Most distributions > kindly add all these helpful mailcap entries. Perhaps you need assistance comprehending the word "specific" (used twice in my question)? I await with interest your achieving that rar

Re: .desktop arbitrary program execution

2005-01-19 Thread Michael Stone
On Wed, Jan 19, 2005 at 04:29:46PM +0100, Florian Weimer wrote: For complex file formats, there is no clear distinction between "opening" a file and "executing" it. Sure there is. For some filetypes execution is an intended effect; that is, you expect arbitrary code to run. For other filetypes ther

Re: .desktop arbitrary program execution

2005-01-19 Thread Florian Weimer
* Florent Rougon: > Florian Weimer <[EMAIL PROTECTED]> wrote: > >> mutt and Gnus are, in typical configurations. Most distributions >> kindly add all these helpful mailcap entries. > > Could you point out a mailcap entry that causes the file to be > *executed*? For complex file formats, there is

Re: .desktop arbitrary program execution

2005-01-19 Thread Florent Rougon
Florian Weimer <[EMAIL PROTECTED]> wrote: > mutt and Gnus are, in typical configurations. Most distributions > kindly add all these helpful mailcap entries. Could you point out a mailcap entry that causes the file to be *executed*? Because running "gqview $file.jpg" is very different from runni

Re: [SECURITY] [DSA 636-1] New libc6 packages fix insecure temporary files

2005-01-19 Thread Don Hayward
Don Hayward at pomobuli.net On Wed, 12 Jan 2005, Martin Schulze wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 636-1 [EMAIL PROTECTED] http://www.deb

Re: .desktop arbitrary program execution

2005-01-19 Thread Vincent Hanquez
On Wed, Jan 19, 2005 at 12:49:57PM +0100, Florian Weimer wrote: > * Rick Moen: > > > Please advise this mailing list of which specific Linux or BSD MUA (or > > specific configuration thereof) is willing to execute a received > > binary or script attachment. > > mutt and Gnus are, in typical confi

unsuscribe

2005-01-19 Thread Aurelien Roux
Le Tue, Jan 18, 2005 at 10:41:00AM +0100, Martin Schulze a écrit : > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > - -- > Debian Security Advisory DSA 644-1 [EMAIL PROTECTED] > http://www.debian.org/s

Re: .desktop arbitrary program execution

2005-01-19 Thread Florian Weimer
* Rick Moen: > Please advise this mailing list of which specific Linux or BSD MUA (or > specific configuration thereof) is willing to execute a received > binary or script attachment. mutt and Gnus are, in typical configurations. Most distributions kindly add all these helpful mailcap entries.

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread Florian Weimer
* s. keeling: > People who don't use stupid Windows email clients have no trouble with > attachments at all. Attachments are a very useful tool; for instance, > for code listings, they arrive unmangled by line wrap. > > Get a better email client, running on a better OS. You mean the OS whose use

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread David Mandelberg
s. keeling wrote: > No, I assume people have half a brain in their heads, look at the > attachment type, maybe save it to a file and inspect it, then maybe > look at it or delete it. Too much work? Whether it's too much work or not, most non-geeks I know don't bother. > Okay, slap a lot of autoloa

Re: .desktop arbitrary program execution

2005-01-19 Thread David Mandelberg
Rick Moen wrote: > Quoting David Mandelberg ([EMAIL PROTECTED]): > > >>Attached. >> >>Save to your GNOME/KDE desktop (like many newbies do) and double click >>the new icon. .desktop files (currently) don't need the x bit set to >>work, so no chmod'ing is necessary. > > > I'm sorry, but the ques

Re: [meta] Set reply-to to something else?

2005-01-19 Thread Adrian von Bidder
On Wednesday 19 January 2005 10.15, Adam Lydick wrote: > Better to bounce or moderate entries from non-subscribers, IMOHO. That > would cut down on the spam quite a lot better than probabilistic filters > as well. Problem: moderating needs manpower. Problem: closing the list to non-subscribers wou

Re: [meta] Set reply-to to something else?

2005-01-19 Thread Vassilii Khachaturov
On Tue, 2005-01-18 at 12:40 +0100, Adrian von Bidder wrote: > Hi, > > With web-board passwords and two or three auto-acks being posted to this > list every week: could we think about setting the Reply-To of I hope that I am not the only one who writes to the auto-ackers and their postmasters that

Re: [meta] Set reply-to to something else?

2005-01-19 Thread Adam Lydick
Better to bounce or moderate entries from non-subscribers, IMOHO. That would cut down on the spam quite a lot better than probabilistic filters as well. There are probably reasons why this hasn't been done, although most non-debian mailing lists seem to take this approach (and see none of the nois

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread Rick Moen
Quoting s. keeling ([EMAIL PROTECTED]): > The problem here is the nitwit factor. Yes, well, a bunch of us have been keeping an eye on Linux MUAs and default mailcap behaviour for 10+ years, to make sure zeal for simplicity doesn't lead coders or distro assemblers to do something dumb. Thus my qu