3 ms·
> For instance, if I do "./budget.pdf", I expect it to run the code from my pdf reader. In this case, an attack would require exploiting a vulnerability in the
by badsectoracula 8y ago
> For instance, if I do "./budget.pdf", I expect it to run the code from my pdf reader. In this case, an attack would require exploiting a vulnerability in the pdf reader. That is to say, budget.pdf is not untrusted code, but rather untrusted data. However, in this case the unstrusted data can claim that it is code; in which case it would be executed as such.
I do not see the difference between running `./budget.pdf` and `evince budget.pdf`' - in both cases all the attacker could rely on is a bug in `pdfviewer`. There is no magic going on with `./budget.pdf`, the command would be transformed to the latter.
- gizmo686 8y agoThe difference is that the attacker can make budget.pdf start with #!/bin/bash and immidietly have arbitrary code execution when I do "./budget.pdf" When I do "evince budget.pdf" the attacker is required to find an exploit of evince.