klinux
Senior User

Joined: Jul 2002

0

05/17, 12:21pm | report spam | close Reply |
Bound to happen..

As OS X becomes more popular. You know OS X has hit the big time when the first adware/spyware for OS X is created!

mbryda
Senior User

Joined: Mar 2002

0

05/17, 12:37pm | report spam | close Reply |
so?

So what. It's still not as bad as Windows which can be exploited just by being on the 'net with no interaction at the keyboard.

testudo
Fresh-Faced Recruit

Joined: Aug 2001

0

05/17, 12:44pm | report spam | close Reply |
Aiiiiieeeeeee!!!!!

Run screaming into the night! This is a time to panic, not to be rational or anything. I'm getting out my al Qaeda kit from the 'duct tape and plastic sheathing' scare from last year and sealing myself in my basement until I get the all clear!

Chiznibitz
Fresh-Faced Recruit

Joined: May 2001

0

05/17, 01:20pm | report spam | close Reply |
i love apple but...

...at least microsoft addresses these problems.

nat
Junior Member

Joined: Mar 2002

0

05/17, 01:29pm | report spam | close Reply |
ms addresses

these problems? is that a joke? do you have any idea the number of "these problems" that microsoft let lie over the years? perhaps you're just too young to remember but microsoft has a long history of NOT addressing these problems. only since "trusted" computing have they started making an effort to plug their incredibly bugged system, you know, the system that needs plugged 3, 4, 5 times a week.

Clive
Mac Enthusiast

Joined: Jan 2001

0

05/17, 01:34pm | report spam | close Reply |
As nothing...

This will be as nothing once the real hole introduced with Panther is found: ...://tell your mac to delete everything

techguysteve
Fresh-Faced Recruit

Joined: Jun 2000

0

05/17, 01:42pm | report spam | close Reply |
This isn't

anti microsoft or anti apple.. just goes to show that when you have millions of lines of code and questionable and somewhat sloppy programming (programs) you will get exploits!

All that's left is for OS X to have it's source code stolen (see MS and Cisco) and then internet will be totally security free... :)

Cadaver
Addicted to MacNN

Joined: Jan 2003

0

05/17, 01:43pm | report spam | close Reply |
Fix soon?

This is a serious exploit. The script could be designed to run anything/issue any command to which the logged-in user has access to.
Hopefully by making this public, Apple will get their butt in gear.
Perhaps its fixed in 10.3.4...

Jeff Hull
Fresh-Faced Recruit

Joined: Dec 1999

0

05/17, 02:03pm | report spam | close Reply |
InternetConfig?

From the http://netilus.org/~insecure/ website:

"To protect yourself:
- disable auto opening of safe files in Safari (bad protection)
- change the help helper in InternetConfig (better protection) "

InternetConfig is an OS 9 program. What gives with that?

kangoo_boo
Dedicated MacNNer

Joined: May 2001

0

05/17, 02:06pm | report spam | close Reply |
IC

InternetConfig has been implemented in MacOSX, and you can edit its values using "More Internet" for example.
You can find this application on the web

testudo
Fresh-Faced Recruit

Joined: Aug 2001

0

05/17, 02:11pm | report spam | close Reply |
Re: This isn't

anti microsoft or anti apple.. just goes to show that when you have millions of lines of code and questionable and somewhat sloppy programming (programs) you will get exploits!

I wouldn't necessarily call this 'sloppy programming', per se. (Although hard to tell one way or the other without seeing the code). Buffer overruns are a huge example of sloppy (and lazy) programming. This is more of an example of the problem using 'shared' code. When you start out with software meant for 'a' task, then use/update it to work with more and more software, you end up with these types of unforseen problems (oh, and if they were foreseen, how come no one saw it before February). This is the same reason Windows has so much problems. They took OLE, changed the name to ActiveX, then said, "hey, this is great stuff, let's use if for browsing as well!", which worked fine but no one took into account how what it could do would cause problems where they were using it.

thjonas
Fresh-Faced Recruit

Joined: Jan 2001

0

05/17, 03:39pm | report spam | close Reply |
Camino affected

I have "Automatically open downloaded files" unchecked in a Camino 0.8 nightly but it still open the dmg file.
Safari isn't the only one with issues.

evanchaney
Fresh-Faced Recruit

Joined: Oct 2000

0

05/17, 04:07pm | report spam | close Reply |
It's funny...

...because I downloaded their proof of concept and although it mounted the DMG, when the thing tried to run I got an error message that said it couldn't because it had been disabled or was not installed.

klinux
Senior User

Joined: Jul 2002

0

05/17, 04:35pm | report spam | close Reply |
Hmm...

testudo wrote: " This is more of an example of the problem using 'shared' code."

Unless you have more information than anyone of us do, I do not see how you can conclude this is due to shared code instead of Apple's sloppy programming?

testudo
Fresh-Faced Recruit

Joined: Aug 2001

0

05/17, 05:18pm | report spam | close Reply |
Re: Hmmm

Unless you have more information than anyone of us do, I do not see how you can conclude this is due to shared code instead of Apple's sloppy programming?

Easy. Because the problem lies in the shared usage of the WebCore, which controls both Safari's and the Help Viewer's HTML display and usage. As such, changes to the core for one use adversely affects the other in an unexpected way.

Oh, and this article is titled "New Safari exploit allows remote code execution". Can it be called remote code when it first is downloaded to your computer and run from there? I thought 'remote' vulnerabilities were those where the code actually was run or executed from a remote location.

Just being my own nit-picky self.

And someone has mentioned its also a problem in Camino, so its not specific to Safari here. If anything, it might be more of a system/internet config/helper app type issue.

Rosyna
Forum Regular

Joined: Aug 2001

0

05/17, 06:14pm | report spam | close Reply |
Not Safari or WebKit bug

It is a bug in Help Viewer and Help Viewer only. It will happen to all browsers. The fix is for Help Viewer to ask the user to launch the script if it is not the Application that originated the AppleEvent.

loopless
Fresh-Faced Recruit

Joined: Oct 2001

0

05/17, 07:14pm | report spam | close Reply |
Nothing to Windows issues

On a scale of 1-10, this vulnerability is a 0.01 compared to the '10'
of the various Windows worms. This is just a case of 'don't download installers or .exe's from unknown sources' which was the issue everyone confronted a couple of years ago.

Ask any sysadmin - I have had a complete LAN of Windows machines infected 'instantly' by an outside user connecting an unauthorized laptop to the network. It is a continual and ongoing nightmare to keep a Windows network secure.

klinux
Senior User

Joined: Jul 2002

0

05/17, 09:24pm | report spam | close Reply |
Really

Loopless, since you are at it, why don't you make Apple's vulnerabiity 0.0001 and Windows 1000000 since you seemed to like hyperbole?

And why is an outside user connecting unauthorized laptop to the network?

LouZer
Fresh-Faced Recruit

Joined: Nov 2000

0

05/17, 10:16pm | report spam | close Reply |
Re: Really

And why is an outside user connecting unauthorized laptop to the network?

Easy, because portable users are an annoying bunch of users who just think "Hey, here's a network cable, let me plug my laptop in" even without asking to make sure its OK. The only way to prevent this is to glue network cables into their sockets and not o leave any open wall socket or unused cable so users don't start swapping them out.

Arty50
Mac Elite

Joined: May 2000

0

05/18, 12:58am | report spam | close Reply |
Who cares about MS

Any discussion about Apple vs. MS is completely ridiculous in this context. Who the h*** cares what each companies track record is when it comes to this exploit. MS didn't exactly cause this to happen to our computers. The simple fact is that Apple screwed up BIG TIME and they need to get off their asses and fix this ASAP.

Macman069
Fresh-Faced Recruit

Joined: Apr 2003

0

05/18, 02:35am | report spam | close Reply |
regardless

of who the h*** did what, tell the person whos home folder just got wiped clean that "well microsoft has bigger problems." quit being a damn zealot and face the reality that some features do turn out to be buggy.justifying or making up for a problem doesnt make it go away. MS might have bigger problems, but it doesnt make your problems any less dangerous. imagine if that script contained 'echo 'YOUR FUCKED
rm ~/*'' then you wouldnt be here typing now would you

-macjedi-

klinux
Senior User

Joined: Jul 2002

0

05/18, 12:41pm | report spam | close Reply |
Hey Loser

"Easy, because portable users are an annoying bunch of users who just think "Hey, here's a network cable, let me plug my laptop in" even without asking to make sure its OK. The only way to prevent this is to glue network cables into their sockets and not o leave any open wall socket or unused cable so users don't start swapping them out."

No, you idiot. The portable users should go wherever they want to and plug in wherever they want to and expect to work. YOUR job is to prevent unauthorized computer on part of the network. Get it straight - this is not an users' problems but the admins problem.

tontondavid10
Fresh-Faced Recruit

Joined: Mar 2004

0

05/19, 04:46am | report spam | close Reply |
sorry klinux

but that attitude is the same one that gets worms into corporate networks cos some idiot thinks it's the admin's problem to stop them from opening unknown attachments, in spite of those same admin guys sending e-mails to everyone telling them not to. No, if the company policy is 'don't plug in your own laptop' and some idiot does it all the same, it's a user problem. I would have thought that you working for a multi million dollar company and all, you'd be sensitive to these issues. As a system admin, I really wouldn't want anybody plugging anything in that hasn't got a minimum of security features installed, and unfortunately that's the case for a lot of laptop users.

Show More Comments

Login Here

toggle

Network Headlines

02/15	Apple asks to sue bankrupt Kodak in...
02/15	Apple voluntarily pulls iPads from...
02/15	Gartner: Apple No 1 vendor in Q4, but...
02/15	Proview: Chinese customs 'unlikely'...
02/15	Cook: iCloud over 100M users, Siri...

Show All

02/15	Apple asks to sue bankrupt Kodak in...
02/15	Apple voluntarily pulls iPads from...
02/15	Gartner: Apple No 1 vendor in Q4, but...
02/15	Proview: Chinese customs 'unlikely'...
02/15	AMD Radeon HD 7750, 7770 GHz Edition...

Show All

02/14	Apple attempting to disrupt Siri hacks...
02/14	Readability iOS app delayed, Android...
02/13	Apple launches 2012 back-to-school...
02/13	Sony Music caught inflating price for...
02/09	Apple explores environment-sensitive...

Show All

02/14	Refurb. 16GB iPhone 4, now only $259...
02/13	Refurb. Flip UltraHD Pocket Digital...
02/10	$380 off refurbished 2.8GHz Mac Pro...
02/09	iHome Dual Alarm Clock for Apple iPod...
02/08	Save 69% on SanDisk Cruzer 32GB USB...

Show All

toggle

New Safari exploit allows remote code execution?

updated 12:10 pm EDT, Mon May 17, 2004

New Safari exploit?

Bound to happen..

so?

Aiiiiieeeeeee!!!!!

i love apple but...

ms addresses

As nothing...

This isn't

Fix soon?

InternetConfig?

IC

Re: This isn't

Camino affected

It's funny...

Hmm...

Re: Hmmm

Not Safari or WebKit bug

Nothing to Windows issues

Really

Re: Really

Who cares about MS

regardless

Hey Loser

sorry klinux

Login Here

Register for our weekly email newsletter:

Connect tools:

Subscribe

to our RSS

Follow us

on Twitter

10 Most Read

10 Most Discussed

MacNN Marketplace

New Safari exploit allows remote code execution?

updated 12:10 pm EDT, Mon May 17, 2004

New Safari exploit?

Related Articles

Recent Articles

Bound to happen..

so?

Aiiiiieeeeeee!!!!!

i love apple but...

ms addresses

As nothing...

This isn't

Fix soon?

InternetConfig?

IC

Re: This isn't

Camino affected

It's funny...

Hmm...

Re: Hmmm

Not Safari or WebKit bug

Nothing to Windows issues

Really

Re: Really

Who cares about MS

regardless

Hey Loser

sorry klinux

Login Here

Register for our weekly email newsletter:

Connect tools:

Subscribe

to our RSS

Follow us

on Twitter

10 Most Read

10 Most Discussed

MacNN Marketplace