mac IE and safari vulnerabilities

[kronas]

lixlpixel has reported a vulnerability in Mac OS X, potentially allowing malicious web sites to compromise a vulnerable system.

The problem is that the "help" URI handler allows execution of arbitrary local scripts (.scpt) via the classic directory traversal character sequence using "help:runscript".

It is reportedly possible to place arbitrary files in a known location, including script files, on a user's system if the Safari browser has been configured to ("Open "safe" files after download") (default behaviour) by asking a user to download a ".dmg" (disk image) file.

This has been confirmed on Macintosh OS X using Safari 1.2.1 (v125.1) and Internet Explorer 5.2.


Solution:
Uncheck ("Open "safe" files after download") in "Safari -> Preferences -> General".

Do not surf the Internet as a privileged user.

Rename the help URI handler.


source: secunia.com

http://secunia.com/advisories/11622/

[macuser_e7]

This specific vulnerability has been addressed in a security update from Apple, available via Software Update or as a download from apple.com.

The security update is also included in the latest OS update (to 10.3.4) for Panther users.

However, other similar vulnerabilities have come to light that Apple has not yet patched. These are simple to guard against and advice can be found here (http://daringfireball.net/2004/05/ounce_of_prevention).

[kronas]

more information on the lack of a security update on the mac OS.

http://www.theregister.com/2004/05/28/mac_bug_mishandled/