1. What actually happened or you saw:
Clicked on link offered on inter-web search engine and Open Office launched per file-association so as to open DOC proffered on interwebs.
2. What you wanted to happen or see:
The process - per file-association - to open the document should’ve opened in virtual environment, i.e., CIS should’ve sandboxed Open Office and the file-open functionality inherent to that application would’ve not been an issue.
3. Why you think it is desirable:
These sorts of files have all sorts of nasty odors associated with them; its best that they’re contained beneath the plexiglass hood so as not to wipe the user out with unpleasant feelings.
4. Any other information:
If neither image files, nor their object are any threat, then what purpose does the sandbox serve? Al local DOC file that is opened by Open Office through file association, is a different scenario than FireFox v26.0.0.2 - Ice Dragon - in CIS v5.12 environmnent that allows unfettered launch of Open Office so as to open the file in qwexion. Maybe I’m being overly paranoid.
If you believe so, I’ll change the CIS security profile from Paranoid to Clean PC and then mayhaps this becomes a non-prollem?
This caught my attention because PDF files openable by Adobe can’t be sandboxed. This is a wrinkle in the oinkment of sandboxing the browser. So I have it set that FireFox v26.0.02, i.e., Ice Dragon, opens PDF in seperaate process - so as to avail of its inherent sandboxing.
But I’m unaware that Open Office has similar functionality, albeit OO is Java based, and there’s the recent security enhancements and all that whatnot.
I’m a little bit confused as to the scenario you are describing. However, I do believe that the way it is intended is that if an unknown file calls on Open Office, in that case Open Office should open sandboxed. Is that the situation you experienced? If not please specify exactly what happened which you believe could be improved.
I’m sorry, but as I am confused about this wish I believe that other users will be as well. Thus, without further discussion I cannot move this to the Waiting Area for voting. I will therefore move this to Rejected.
WxMan1, I have no problem moving this back to the main Wish Request board for continued processing. However, in order to do that I will need for you to answer the questions I raised above so that I can better understand this wish.
I'm a little bit confused as to the scenario you are describing. However, I do believe that the way it is intended is that if an unknown file calls on Open Office, in that case Open Office should open sandboxed. Is that the situation you experienced? If not please specify exactly what happened which you believe could be improved.
Thank you.
I could run the browser in the sandbox, and then it wouldn’t matter what it did - everything and anthing it downloaded or spawned would be w/ in virtual space; the entire world browser malware sees would be a virtual.
I like that - wickedly cool - in that it exposes the behavior of whatever unknown image file towards CIS heuristic CORA, I.E., conscientious objector rational algorithm.
From what I see, if the browser is freely running w/ in CIS security profile - paranoid - and a URL is clicked that corresponds to a document that through file-association implements Open Office, the file is opened - albeit in seperate process / window - but not in the sandox.
IF I run the browser, i.e., Ice Dragon, in the sandbox, then there’s issues with opening PDF files from any arbitrary URL; sandboxed images spawn sandboxed more images.
I attribute that the problem with sandboxing Adobe Reader sessions is that the inherent sandbox that Adobe Reader sessions operate in is technology incompatible with CIS sandbox technology.
Dunno. I’m just alarmed that clicking a URL that points to a PDF file launches OpenOffice - in its own window (not tabbed w/ in browser session) - maybe I should change the security detail from paranoid to safe, clean or training mode, eh?
I have just recently discussed a very similar behavior with a fellow Mod. The way this should work is that if OpenOffice is opened by a trusted program, such as a trusted browser, it will be run without restriction. However, if an unknown program were to open it, such as an exploit program, OpenOffice should automatically be run virtualized. Thus, in terms of this Wish, the behavior needed to prevent exploits from being able to escape and create havoc should already be implemented. Thus, I believe this should remain in Rejected, as CIS is already protected from problems like this.
However, if you have found, or seen, any evidence of a bypass of CIS via a mechanism like this, please create a bug report as this would represent a serious vulnerability. Have you seen any evidence of a bypass?