----- Original Message -----
From: "Neil Bothwick" <neil@...>
To: "Bruce Steers" <awnpipe@yahoogroups.com>
Cc: <The-Crypt@yahoogroups.com>; <amiga_sa@yahoogroups.com>;
<awnpipe@yahoogroups.com>; <The-Crypt@yahoogroups.com>
Sent: 11 November 2001 11:31
Subject: Re: [amiga_sa] Re: security risk


> > a better fix would be to make YAM (or whatever) check to see if AWNPipe: is
> > mounted and if it is un-mount it before using yam.
>
> All YAM needs to do is strip escape codes from data before passing ti
> elsewhere. Or it could check that any file it tries to load is really a
> file.
>
> > this could be done by using an ARexx command set as YAM's startup-script (or
> > before getting mail) the following script should be either saved as a script
> > file in REXX and called from your prog or cut-n-pasted into an existing
> > startup-script
>
> That would mean you couldn't use, for example, AWebModes while YAM was
> running. If you have a permanent connection and YAM is always running,
> this is a major inconvenience.

not really (if AWebModes is well coded)
AWeb modes should mount the pipe as it loads (all my awnpipe tools do)

But you would have to close awebmodes before you next check mail

> > the report mentioned ANY MUI internet prog so i guess it includes V and IB
as
> > well ? also the report mainly spoke of APIPE: the above script can be
> > modified by changing the references to AWNPipe: to whatever pipe you want
> > checked.
>
> V is secure, because Vapor have been aware of this problem for some time
> and have made sure it doesn't pass unchecked data to the system. AWeb is
> also secure from similar exploits. I don't know about IBrowse.

Aweb will be ok as it is not mui :^)

> The safest approach is to remove AWNPIPE if nothing you have uses it.
> Otherwise, rename it and change the scripts that call it. If the pipe
> has an arbitrary name, no external source will know the name to use.

but that sounds like more of a pita than my idea :(
the safest way is to stop using MUI internet apps untill they are fixed.

but the question remains ,,, IS awnpipe vulnerable or not ?