Running command.com from within Netscape's MIME dialog box

[Bill Moseley]

At 10:59 AM 7/26/96 -0700, Mark Cyzyk wrote:
>I was greatly distressed by Bill Moseley's recent post regarding running
>command.com from within Netscape's MIME dialog box.  It certainly appears that
>this is a way to break into a DOS shell even if a security program like Ikiosk
>is locking out dangerous menu items.

It seems as if the new version of Ikiosk will allow you to disable the
dialog screens in addition to the menu items.  This will be a big help.  Now
if they would add a feature that would only allow saving files to the A:
drive (to prevent accessing files on the hard disk) we would be in great shape!

>
>However, I found that if the attributes for the netscape.ini file are set to
>read-only, Netscape will indeed first boot up the familiar MIME box, but upon
>writing to the ini file (and being unable to do so) it will merely prompt the
>user for a location in which to save the file.  In this way, no executables are
>run via the MIME dialog box.

Perhaps it varries with different versions of Netscape.  I just tried this
with Netscape version 2.02 16 bit and it let me run command.com without any
problem -- even with the .ini file set readonly.  But, since the .ini file
was readonly it didn't save "command.com" as the default viewer for the new
MIME type.

To try it yourself, add "bat" to any MIME type in Netscape.  I picked at
random "application/rtf=" and added "bat" and then selected "Ask User".

Click "OK" until you get back to the browser window and then enter the URL
"file:///c|/autoexec.bat", the select "Pick App" and then "Browse" then
select to view all files (*.*) and then click on command.com and click "OK"
and away you go!  Again, maybe different versions of Netscape will work
differently.




Bill Moseley
mailto:moseley at netcom.com