Thoughtful, detailed coverage of the Mac, iPhone, and iPad, plus the best-selling Take Control ebooks.

 

 

Pick an apple! 
 
Always Show Recipient In iChat

In iChat under Snow Leopard, choosing View > Always Show Recipient Bar puts a buddy's status message and color at the top of any iChat window. It can also be used to select among multiple open iChat logins you have to send a message to that buddy, or to select among multiple accounts you have registered in Address Book for that buddy.

Submitted by
Doug McLean

 
 

Security Issue with Email Attachments

Send Article to a Friend

A recent CIAC security advisory identifies a potentially dangerous flaw involving email clients processing MIME attachments with unusually long file names (more than 200 characters). The problem, primarily affecting Windows versions of Microsoft Outlook, Outlook Express, and Netscape Messenger, could cause a buffer overflow that could crash the email client or potentially cause code to execute on the client's system, even if the user does not attempt to open the message or the attachment. Microsoft and Netscape have issued security advisories for their products, along with patches for the Windows versions of their software.

<http://www.ciac.org/ciac/bulletins/i-077a.shtml>
<http://www.microsoft.com/ie/security/oelong.htm>
<http://home.netscape.com/products/security/ resources/bugs/longfile.html>

Historically, the way to take advantage of a buffer overflow is to craft the precise binary data that will get past the target program's bounds checking, then somehow cause that data to be executed as if it were code. If an email program were susceptible to this problem and encountered a message designed to exploit it, the most likely result would be a crash. (There's nothing new about email programs crashing while processing badly formatted messages.) To execute malicious code, the extraneous data must be designed to target a particular email program running on a particular operating system, so a Mac running Eudora would be immune to a message designed to execute code on a Pentium-based system running Windows 98 and Outlook Express.

To date, there are no known instances of this code-execution vulnerability being exploited. The general alarm about this problem stems from the wide deployment of potentially vulnerable Windows-based clients from Microsoft and Netscape. In addition, even if the code-execution vulnerability turns out to be purely theoretical, the discovery of a reproducible way of crashing numerous copies of heavily used email programs is concerning. Even though patches to those programs are available now, it will take several months for a substantial portion of the user base to upgrade, and for commercial products to ship with corrected versions.

Users of Microsoft Outlook Express for the Mac version 4.0, and version 4.0.1 with build numbers less than 297 (choose About Outlook Express from the Apple menu to see the build number of your copy) can download a 2.2 MB update from Microsoft to correct any potential vulnerability. Qualcomm confirms that current versions of Eudora Pro and Light for Macintosh and Windows are not susceptible to this problem; according to Netscape, no Macintosh versions of Netscape mail software are compromised. Bare Bones Software's Mailsmith also does not suffer a security risk from this problem. We don't have any information about Emailer, but, again, the potential vulnerability is extremely low.

<http://www.microsoft.com/msdownload/iebuild/ oebuff_mac/en/oebuff_mac.htm>
<http://www.eudora.com/>
<http://www.barebones.com/>

 

Fujitsu ScanSnap Scanners — Get on the path to paperless bliss!
Convert double-sided documents to PDF with the one-button ScanSnap.
Scan documents, business cards, and receipts, and eliminate
paper piles from your desk. Visit us at: <http://www.ez.com/sstb>