Xref: utzoo news.sysadmin:1785 comp.unix.wizards:13114
Path: utzoo!utgpu!watmath!clyde!att!rutgers!mailrus!cornell!rochester!uhura.cc.rochester.edu!ur-valhalla!badri
From: badri@valhalla.ee.rochester.edu (Badri Lokanathan)
Newsgroups: news.sysadmin,comp.unix.wizards
Subject: Re: Trojan horse possible with news readers
Summary: Yes, it will execute, if modeline is set
Message-ID: <1627@valhalla.ee.rochester.edu>
Date: 2 Dec 88 22:11:01 GMT
References: <6775@rosevax.Rosemount.COM> <1261@vsi1.UUCP>
Organization: UR Dept. of Electrical Engg, Rochester NY 14627
Lines: 19

In article <1261@vsi1.UUCP>, lmb@vsi1.UUCP (Larry Blair) writes:
> I don't believe that those braindamaged versions of vi will execute:
> 
> > ex:!sh -c 'echo any command'>/tmp/NEWSBUG:

Yes it will (at least the version of ex documented in the Mt. Xinu
user docs,) since the caveats are 
	(0) modeline must be set
	(1) The line should appear in the first or last 5 lines
	(2) The string ex: or vi: preceeded by a tab or a space may be
	    anywhere in the line and anything after the : is
	    interpreted as editor commands.

The only safeguard is to disable modeline.
-- 
"We will fight for the right to be free {) badri@ee.rochester.edu
 We will build our own society         //\\ {ames,cmcl2,columbia,cornell,
 And we will sing, we will sing       ///\\\ garp,harvard,ll-xn,rutgers}!
 We will sing our own song."  -UB40    _||_   rochester!ur-valhalla!badri