OSX 10.3 [Panther] service announcement

[jazzfish]

Doubtless those of you to whom this applies have seen it already, but just in case you haven't, there's a security hole in Panther that wants patching.

"It is possible to write a URL that, when invoked from one’s default browser, invokes Apple’s Help program, which is itself a mini-browser which uses a subset of HTML. The trouble is that unlike a well-written, full-fledged, OSX browser, the Help program is (a.) fully scriptable; and (b.) fully capable of running any application or command for which the user has privileges."

Comments

[skreidle.livejournal.com]

Well, nothing was posted about it in macosx, so I passed it on. Eep!

[mikailborg.livejournal.com]

Until Apple patches this, Safari users can protect themselves with a menu selection and two clicks.

With Safari open and the foremost application, select "Preferences" from the "Safari" menu. Click the "General" icon, and make sure "Open 'safe' files after downloading" is unchecked. Boom, vulnerability gone.

[jazzfish]

You sure? cwolf disagrees. ["Some of the early primitive examples of this exploit depended on Safari's auto-open behavior and could be foiled by turning it off, but in the general case the exploit does not require Safari to auto-open anything and there are working non-malicious examples of the exploit out there which clearly still function even with Safari auto-open disabled. Also, this is not a Safari problem but a system-wide issue with the handling of help. . . ."]

Well, I was...

[mikailborg.livejournal.com]

I was sure until this morning, when I read new information similar to what cwolf said.

So I just downloaded the More Internet freeware control panel from versiontracker.com, and set the handler for "help" documents to my Chess program. Not a perfect solution, but it'll keep me safe until the hole is patched.

[(Anonymous)]

Between this and the recent trojans it's encouraging to see that Macs have developed enough of a presence to warrant such attacks.

Jonathan

[mikailborg.livejournal.com]

Yeah, quite the backhanded compliment, eh?

[laughin.livejournal.com]

I am sure it will get fixed when the next wildlife feline version somes out. ;)