Re: Adobe Photoshop CS - vulnerability or feature?
Re: Adobe Photoshop CS - vulnerability or feature?
- Subject: Re: Adobe Photoshop CS - vulnerability or feature?
- From: "John C. Welch" <email@hidden>
- Date: Thu, 21 Oct 2004 07:58:00 -0500
On 10/21/04 6:46 AM, "Martin Orpen" <email@hidden> wrote:
> The Help menu can be used to launch applications using the "file:" url
> scheme.
>
> I was pleased that CS came with a new "File=>Scripts" menu option - but
> didn't expect to find this alternative method:
>
>
> 1. Create a simple AppleScript:
>
> display dialog "Oh dear, this app was launched from a URL"
>
>
> 2. Save it as an application here:
>
> /Applications/Adobe Photoshop CS/Help/Additional How To Content/test.app
>
>
> 3. Open the file "Add_001.howto" which is in the same folder as your new
> "test.app" in any text editor. Or use any method you want to add the
> following line of text:
>
> "How to launch malware" "Security Risk?"
> file:///Applications/Adobe Photoshop CS/Help/Additional How To Con
> tent/test.app
>
>
> 4. Launch Adobe Photoshop CS and select your new menu option "How to launch
> malware => Security Risk?" from the "Help" menu.
>
>
> Adobe's documentation boasts that you can also point to external links if
> you want :-(
>
> I'm going to do a bit more work on this - but it looks like vulnerability
> that needs fixing.
>
> Comments anybody?
Yeah, while it's not a really serious one in the sense of being easily
remotely used, it's pretty damned dumb. For more fun, try
file:////System/Library/Frameworks/ScreenSaver.framework/Versions/A/Resourc
es/ScreenSaverEngine.app
As the app to run, or a shell script. True, it pops a terminal window to run
the shell script, but have it run the right script, and your home directory
is toast before you can stop it.
<sigh>...you know, you think people see that Apple had problems with this,
and would learn...nope.
I know some folks at Adobe, I'll tell them
--
"Oh, to be young again. To be sure you know everything, and yet be as
completely stupid as a poorly educated lump of marble.
Yeah. All the people our age spend countless millions to find a way to get
back to being that when a well-placed baseball bat to the skull is so
cheap."
Fred and Faye Macintire, "Something Positive
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Applescript-users mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden