On Monday, 6 February 2006 21:00, Eric Rostetter wrote:
> Quoting blahblah (at) hotmail (dot) com [email concealed]:
> > Although, you may want to run AV in linux for various reasons,
> > some misleading points were made:
>
> Yes.
>
> > "If you run wine, zen, mach, vmware, or anything that runs or can
> > run windows (or another vulnerable OS), than you should run AV in
> > at least the virtual machine, and preferably in both linux and
> > virtual machine."
> >
> > Is a little misleading:
>
> As is your answer...
>
> > wine - Just because a windows exploit exists in windows, does not
> > mean it exists in wine. For example - if windows has a buffer
> > exploit somewhere in its dlls, that does not mean it will exist
> > in wine (and vice-versa). This is because the wine team is
> > re-implementing the windows API without looking at the windows
> > code, and the implementations will differ.
>
> And as we just saw with the last big windows exploits, it _did_
> exist in wine as well as windows. So the fact is, wine will be
> vulnerable to some of, but not all of, the same things as windows.

No that's not true. Perhaps you don't understand the nature of that
specific problem. The WMF exploit took advantage of a broken
algorithm. Wine reverse engineered the algorithm and thus it displays
the same broken behaviour as the Microsoft original.

it is not possible to make general predictions about what will happen
under an emulator, as it depends on the nature of the exploit, what
the exploiting code is doing and how the underlying mechanism is
implemented *for that architecture*.

Instead of wondering if wine is safe, which is a stupid question like
"are cars safe?", we should rather look at specific exploits on their
own merits and not try to lump problems into arbitrary groups and
pretend that a specific case must apply to the general case

> > zen, mach, vmware - just because the "can" run windows does not
> > mean they "will" be running windows. If they aren't, don't
> > bother.
>
> As I pointed out, this isn't a windows problem. Viruses exists for
> windows, Mac OS, windows products that run on other OS versions,
> etc. So if you run any OS on there, or any product on there, that
> is known to be virus friendly, then run an AV...

True. Just because one isn't aware of a current exploit for say any
arbitrary *nix doesn't mean there will never be one. So AV is usually
a good idea. But as always, the degree of defense has to be
appropriate for the machine/data in question and the degree of
threat.

Again, there's no one solution that fits all

> > "If you run openoffice, you are open to macro viruses and all the
> > same things that hit MS Office apps, and you should run an AV if
> > you don't want to be a hit by them, or spread them to others."
> >
> > Not correct in the least - openoffice can't run word macros
> > (although you can chose to preserve them). Even if that
> > capability exists at some point, this statement is still flat
> > wrong - because the open office team would be re-implementing the
> > code, and the vulnerabilities in the windows implementation would
> > in all probability not exist in the open office implementation
> > (see the wine argument). Most likely they would just have
> > different vulnerabilities ;)
>
> Can you prove this? I don't believe it is true. The one advantage
> of OpenOffice is that it will not automatically run any macros like
> MS Office did. So you have to manually run the macro to get
> infected. But since most novice users will run anything sent to
> them, this is only of limited value for a large number of novice
> users.

Are we all missing the point about Office macros? They are *VBA* code,
and require a VB runtime to execute. The fact that MS enabled them to
run by default in some installations is completely irrelevant. The
only thing that is important is what will happen when {user/OS}
causes the code to run. No VB runtime = nothing will execute = no
possible harm can be done (at least not in the universe I live in)

OpenOffice.org never runs VBA code. It does not have a VB runtime or
anything approximating it. What it does have is StarBasic, an
altogether different beast.
>
> I know OpenOffice exluded some features of MS Office macros due to
> security, but I don't think you can say they completely eliminated
> macro virus usage in OpenOffice.
>
> > "True. But you can help spread them."
> > Bingo!
> > And that's why ClamAV was made!
> >
> > Stu

--
Alan McKinnon
alan at linuxholdings dot co dot za
+27 82, double three seven, one nine three five

[ reply ]