OSX 10.3 [Panther] service announcement

[jazzfish]

Doubtless those of you to whom this applies have seen it already, but just in case you haven't, there's a security hole in Panther that wants patching.

"It is possible to write a URL that, when invoked from one’s default browser, invokes Apple’s Help program, which is itself a mini-browser which uses a subset of HTML. The trouble is that unlike a well-written, full-fledged, OSX browser, the Help program is (a.) fully scriptable; and (b.) fully capable of running any application or command for which the user has privileges."

Comments

[skreidle.livejournal.com]

Well, nothing was posted about it in macosx, so I passed it on. Eep!

[mikailborg.livejournal.com]

Until Apple patches this, Safari users can protect themselves with a menu selection and two clicks.

With Safari open and the foremost application, select "Preferences" from the "Safari" menu. Click the "General" icon, and make sure "Open 'safe' files after downloading" is unchecked. Boom, vulnerability gone.

[(Anonymous)]

Between this and the recent trojans it's encouraging to see that Macs have developed enough of a presence to warrant such attacks.

Jonathan

[laughin.livejournal.com]

I am sure it will get fixed when the next wildlife feline version somes out. ;)