Re: Hypothetical LaTeX security holes (was: forwarded message from Jeff Licquia)
Martin Schröder <firstname.lastname@example.org> wrote
> On 2002-07-17 00:44:21 -0400, Simon Law wrote:
>> I can imagine latex.ltx containing a couple extra
>> \openin15=.ssh/identity , \openin15=.gnupg/secring.gpg and
>> \openout15=.shrc commands as put there by someone who has cracked
> This is not possible on a default TeX installation.
(snip valid reasons)
A related attack might be possible. For example,
Or a steganography attack that hides ~/.ssh/secring.gpg in the resultant
And to move this back to a more debian-focused discussion, let's imagine
that similar code is wrapped with (I'm not much of a TeX user)
if fileexists(/etc/debian_version) then
%do the exploit code
According to the LPPL (as I read it), Debian does not have the right to
change latex.ltx without renaming it (latex.ltx? or the whole program?), and
the LaTeX maintainers may have little interest in fixing an "obscure bug"
that only affects a small set of users.
To UNSUBSCRIBE, email to email@example.com
with a subject of "unsubscribe". Trouble? Contact firstname.lastname@example.org