oss-sec mailing list archives

Re: On the issue of MIME handlers that execute arbitrary code (e.g. Wine)


From: Aaron Rainbolt <arraybolt3 () riseup net>
Date: Tue, 19 May 2026 19:46:29 -0400

On Tue, 19 May 2026 19:30:42 -0400
Aaron Rainbolt <arraybolt3 () gmail com> wrote:

If all applications followed the xdg-mime manpage's advice to never
execute code when opening a file, this wouldn't be that big of a
problem. This is where Wine comes in; it ships a desktop file that
registers Wine as a MIME handler for
'application/x-ms-dos-executable', 'application/x-msi', and
'application/x-bat'.    

Note that not all packaged versions of Wine do this: for example in 
Debian, this MIME handler was disabled in 2013 in response to 
<https://bugs.debian.org/327262>.  

Good. Unfortunately, convincing upstream to follow suit is proving to
be a challenge...

Someone in the Wine bug report mentioned portability as a concern with
getting Wine to handle EXE files transparently. binfmt-misc can be used
on Linux, but not on the BSDs, which Wine also supports. I'm not sure
there is any good mechanism on BSD to mark a file type as executable,
which is ultimately what Wine is trying to do. MIME handlers are a
(bad, but possibly the only portable) way to work around that
limitation.

--
Aaron

Attachment: _bin
Description: OpenPGP digital signature


Current thread: