Re: KDE Security Advisory: URI Handler Vulnerabilities

2004-05-18 Thread Nick Boyce
On Tue, 18 May 2004 21:54:06 +0200, Alejandro Exojo wrote: >El Martes, 18 de Mayo de 2004 04:09, Nick Boyce escribió: [...] >> As a Woody KDE user I'm aware that the usual packager >> suspects^H^H^H^H^H^H^H^Hheros are all somewhat preoccupied .. > >You're using backported KDE, right? If you use of

Re: KDE Security Advisory: URI Handler Vulnerabilities

2004-05-18 Thread Hendrik Sattler
Am Tuesday 18 May 2004 21:54 schrieb Alejandro Exojo: > 4. Change to the package's root directory, and run dpkg-buildpackage -us > -uc -rfakeroot If you don't need a source package (and want to save some disk space), you can add the option -b to only build the binary packages. HS -- Mein GPG-K

Re: KDE Security Advisory: URI Handler Vulnerabilities

2004-05-18 Thread Nick Boyce
On Tue, 18 May 2004 21:54:06 +0200, Alejandro Exojo wrote: >El Martes, 18 de Mayo de 2004 04:09, Nick Boyce escribió: >> It would appear the right advice is to stop using Konqueror to surf >> the web until we have our KDEs fixed. > >If you don't visit cracker's websites, you can feel more or less

Re: KDE Security Advisory: URI Handler Vulnerabilities

2004-05-18 Thread Alejandro Exojo
El Martes, 18 de Mayo de 2004 04:09, Nick Boyce escribió: > It would appear the right advice is to stop using Konqueror to surf > the web until we have our KDEs fixed. If you don't visit cracker's websites, you can feel more or less secure. I don't waste my time filling a website with malicious l

Re: KDE Security Advisory: URI Handler Vulnerabilities

2004-05-18 Thread Anders Ellenshøj Andersen
On Tuesday 18 May 2004 04:09, Nick Boyce wrote: > For the record : KDE.org has published a security bulletin : > http://www.kde.org/info/security/advisory-20040517-1.txt > Or I suppose switching to Mozilla for a while may be a sensible option Fortunately trying to gain remote access to unix syste

KDE Security Advisory: URI Handler Vulnerabilities

2004-05-17 Thread Nick Boyce
For the record : KDE.org has published a security bulletin : http://www.kde.org/info/security/advisory-20040517-1.txt There are various problems, but this appears to be the worst bit : The telnet, rlogin, ssh and mailto URI handlers in KDE do not check for '-' at the beginning of the hostnam