Thoughtful, detailed coverage of the Mac, iPhone, and iPad, plus the best-selling Take Control ebooks.

 

 

Pick an apple! 
 
Enabling Auto Spelling Correction in Snow Leopard

In Snow Leopard, the automatic spelling correction in applications is not usually activated by default. To turn it on, make sure the cursor's insertion point is somewhere where text can be entered, and either choose Edit > Spelling and Grammar > Correct Spelling Automatically or, if the Edit menu's submenu doesn't have what you need, Control-click where you're typing and choose Spelling and Grammar > Correct Spelling Automatically from the contextual menu that appears. The latter approach is particularly likely to be necessary in Safari and other WebKit-based applications, like Mailplane.

Submitted by
Doug McLean

 
 

Significant Safari Exploit Discovered

Send Article to a Friend

A potentially critical security flaw has been uncovered in Apple's Safari Web browser, which may enable attackers to execute arbitrary Unix shell scripts on a user's machine simply by following a link on a Web site. Apple has yet to comment or release a patch, but in the meantime, we'd urge Safari users to disable the "Open 'safe' files after downloading" option in General pane of Safari's preferences. (In fact, we've recommended disabling this option since May 2005, when a weakness involving Dashboard widgets was discovered).

<http://db.tidbits.com/article/08119>

The root of the exploit involves the way Mac OS X determines which program should launch files of a particular type. Under Mac OS 9, applications were associated with files using four-letter creator codes stored in a file's resource fork; under Mac OS X, applications are associated with file via a more arcane system involving metadata and a file's extension. By renaming a Unix shell script to a "safe" extension (like .pdf, .jpg, etc.), setting the script file's executable bit, and compressing the script with the Zip archiving utility, Safari will happily download the script, decompress it, assume the script is "safe," then blithely pass it off to the Mac OS X Terminal application for execution. An attacker could easily use such a script to delete a user's home directory, damage the computer's configuration, or obtain personal data. (For more information, see Matt Neuburg's "Of Files, Forks, and FUD" elsewhere in this issue.)

Safari is the only Web browser known to be affected, although it is possible other programs could be vulnerable to similar attacks. The Camino and Firefox Web browsers are not vulnerable to this particular exploit.

Danish security firm Secunia has listed the flaw as "extremely critical," and has posted a harmless sample exploit of the flaw so users can test if their systems are vulnerable. Heise Online has another demonstration of the exploit.

<http://secunia.com/advisories/18963>
<http://secunia.com/mac_os_x_command_execution_ vulnerability_test/>
<http://www.heise.de/security/dienste/ browsercheck/demos/safari/Heise.jpg.zip>

Users may also be able to protect themselves from the exploit by removing the Terminal application from its default location in Applications > Utilities. (However, doing so may confuse future system updaters, so users would probably have to remember to put it back before installing new software.)

By default, Safari's "Open 'safe' files after downloading" option is disabled on new Mac OS X 10.4.5 installations, so many users may be safe from this exploit by default. However, merely running Mac OS X 10.4.5 is no guarantee of safety: we've confirmed systems updated to Mac OS 10.4.5 from earlier versions may well leave Safari's "Open 'safe' files after downloading" option enabled. So, to be safe, check that the option is disabled on your system regardless of the version of Mac OS X you're using.

 

New for iOS 8: TextExpander 3 with custom keyboard.
Set up short abbreviations which expand to larger bits of text,
such as "Tx" for "TextExpander". With the new custom keyboard,
you can expand abbreviations in any app, including Safari and
Mail. <http://smle.us/tetouch3-tb>