Paul Szabo wrote: > Christian Sciberras <uuf6...@gmail.com> wrote: > >> ... the user has opened the "bad" file ... > > The victim "views" a "data" file, does not (directly) run an executable. > The data file could be as harmless as a Word document or a plain-text > file.
Word (resp. MS Office) documents ain't harmless: they may contain VBA code. Plain text files can be harmfull too: any *.pl, *.js, *.vbs, *.reg which gets opened^Winterpreted by its associated application, not just viewed in the editor, can cause havoc. And it doesn't really matter whether the user double-clicks the file, or starts the resp. application first and opens the file from there. Stefan _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/