In article , Peter Duniho wrote:
architectural problem that just giving your file an .exe extension makes
them executable, and therefore if you find another bug like the MIME
bugs OE suffered from, you can leverage it to make executables attached
to email run automatically.

As opposed to Unix where you can attempt to run ANY file, regardless of
extension? I'm not sure what your point here is.

My point is that since under Unix, when email arrives, attachments don't
have the execute bit. They can't. They aren't on the filesystem. You
therefore can't double-click an executable attachment to run it from
your email client which is a GOOD thing. A bug in the email client that
automatically opens attachments can't be leveraged to run executables,
as it has with Outlook Express. MIME type bugs can't be exploited to
trick the mail client into automatically running executables - because
the file never has execute permission when it's sitting in your inbox.

Under Windows, on the other hand, .exe is execute permission *unless
it's already on the disk and you can use cacls to clear execute
permissions!* So the file is executable by default, merely by having a
..exe (or .bat, or one of about two dozen three letter extensions). Bugs
in MSIE are *still* being found that can be used to exploit this very
basic architectural vulnerability.

As for security cultu consider this. Although Apache by far and large
is the most common web server, all the serious exploits so far has been
for the minority web server - IIS (Code Red et al.)

See my other message.

IIS is the niche product here, but it gets all the press about its
vulnerabilities.

--
Dylan Smith, Castletown, Isle of Man
Flying: http://www.dylansmith.net
Frontier Elite Universe: http://www.alioth.net
"Maintain thine airspeed, lest the ground come up and smite thee"