Timeline for Is it ever safe to open a suspicious HTML file (e.g. email attachment)?
Current License: CC BY-SA 4.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 1, 2019 at 10:04 | comment | added | Hobbamok | I think text editors are pretty safe, since, when sending an HTML file, one usually does expect it to be opened in a browser. [However, thats Security by Hope, which is definitely the worst approach there is] | |
| Mar 31, 2019 at 2:28 | comment | added | forest | @ihavenoidea No! That would be security through obscurity, which is a bad thing. An obscure text editor would likely have more vulnerabilities, potentially even ones that work on multiple text editors, not just one. | |
| Mar 30, 2019 at 22:31 | comment | added | Matija Nalis | It is true that you can never be 100% safe. But, also not, you might get exploited even without opening any attachment, just by clicking at email (or, depending on how lousy your email client is, even just by receiving email without any additional action from your side) | |
| Mar 30, 2019 at 19:25 | comment | added | ihavenoidea | So if I use a really underground text editor (that is really really unpopular) I would be safe by opening it on this editor? | |
| Mar 30, 2019 at 8:09 | comment | added | Jerry B | Since you can execute code as a normal function, vim is not just an editor. The part being attacked is the non-editor part. Are there any vulnerabilities for plain editors? | |
| Mar 30, 2019 at 6:29 | comment | added | Brian McCutchon | @Numeri You can execute shell commands from VimScript. | |
| Mar 30, 2019 at 0:26 | comment | added | sleske | @Numeri: This one for example: cvedetails.com/cve/CVE-2016-1248 - "execution of arbitrary code if a file with a specially crafted modeline is opened". So just opening a file is enough. | |
| Mar 30, 2019 at 0:02 | comment | added | Numeri | @sleske Most of those have to do with vimscripts. How many would actually allow a file to harm you just by being viewed/opened and navigated? | |
| Mar 29, 2019 at 22:54 | comment | added | sleske | @Putvi: Here's the list of vulnerabilities for vim : cvedetails.com/vulnerability-list/vendor_id-8218/opec-1/… . It lists quite a few... | |
| Mar 29, 2019 at 19:42 | comment | added | Max | I have never heard of an attack against a text editor. It is certainly in the realm of possibility, but I would be very surprised to see a practical example of it. | |
| Mar 29, 2019 at 17:57 | comment | added | Vit | Do you have any examples? | |
| Mar 29, 2019 at 17:56 | comment | added | Cubic | @Putvi Why the surprise? The primary function of a text editor is to manipulate buffers, it's very easy to sneak in buffer overflows if you're not careful. | |
| Mar 29, 2019 at 17:38 | comment | added | Vit | Buffer overflow in a text editor? | |
| Mar 29, 2019 at 13:10 | history | edited | Thomas | CC BY-SA 4.0 |
added 2 characters in body
|
| Mar 29, 2019 at 12:55 | review | First posts | |||
| Mar 29, 2019 at 14:51 | |||||
| Mar 29, 2019 at 12:54 | history | answered | Thomas | CC BY-SA 4.0 |