Something else worth mentioning is that 'trackerd' is a security 
nightmare waiting to happen.  It is like a ticking time bomb delivered 
with the OS.  Any program which opens files becomes subject to 
corruption or maligned access.  In the typical file user scenario, the 
user decides which files to open and with which software and under 
what user ID.  In the 'trackerd' scenario, the indexer will attempt to 
open any file it thinks it recognizes and any defect in the file 
reader could be exploited to cause harm.

I have collections of files here which were intentionally designed to 
cause harm to the programs which open them.  If 'trackerd' was to 
attempt to open one of these, then it may misbehave.

Sun has traditionally been very slow to respond to file based security 
exploits.  It took seemingly forever for Sun to respond to a PNG 
security exploit.  It took almost two years for Sun to respond to an 
ImageMagick exploit where arbitrary Unix shell commands could be 
executed by simply opening a file.  The actual exploit existed for 
perhaps seven years.  The fix was finally delivered in a patch just 
this last week so the problem may still exist in unpatched Solaris 
10U6.

Bob
======================================
Bob Friesenhahn
bfriesen at simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/


Reply via email to