Xref: utzoo news.sysadmin:1785 comp.unix.wizards:13114 Path: utzoo!utgpu!watmath!clyde!att!rutgers!mailrus!cornell!rochester!uhura.cc.rochester.edu!ur-valhalla!badri From: badri@valhalla.ee.rochester.edu (Badri Lokanathan) Newsgroups: news.sysadmin,comp.unix.wizards Subject: Re: Trojan horse possible with news readers Summary: Yes, it will execute, if modeline is set Message-ID: <1627@valhalla.ee.rochester.edu> Date: 2 Dec 88 22:11:01 GMT References: <6775@rosevax.Rosemount.COM> <1261@vsi1.UUCP> Organization: UR Dept. of Electrical Engg, Rochester NY 14627 Lines: 19 In article <1261@vsi1.UUCP>, lmb@vsi1.UUCP (Larry Blair) writes: > I don't believe that those braindamaged versions of vi will execute: > > > ex:!sh -c 'echo any command'>/tmp/NEWSBUG: Yes it will (at least the version of ex documented in the Mt. Xinu user docs,) since the caveats are (0) modeline must be set (1) The line should appear in the first or last 5 lines (2) The string ex: or vi: preceeded by a tab or a space may be anywhere in the line and anything after the : is interpreted as editor commands. The only safeguard is to disable modeline. -- "We will fight for the right to be free {) badri@ee.rochester.edu We will build our own society //\\ {ames,cmcl2,columbia,cornell, And we will sing, we will sing ///\\\ garp,harvard,ll-xn,rutgers}! We will sing our own song." -UB40 _||_ rochester!ur-valhalla!badri