Thoughtful, detailed coverage of the Mac, iPhone, and iPad, plus the best-selling Take Control ebooks.

 

 

Pick an apple! 
 
Turn Word 2008 Notes into a To-Do List

In the Word 2008 Notebook Layout View (View > Notebook Layout View), bring up the Formatting Palette (View > Formatting Palette). Look for the Note Flags section in the Formatting Palette. Select the flag type, type in your reminder or even assign yourself an Entourage 2008 task. Check off your to-dos once the task is complete.

Visit Mactopia - Word 2008

Submitted by
Microsoft MacBU

 
 

Significant Safari Exploit Discovered

Send Article to a Friend

A potentially critical security flaw has been uncovered in Apple's Safari Web browser, which may enable attackers to execute arbitrary Unix shell scripts on a user's machine simply by following a link on a Web site. Apple has yet to comment or release a patch, but in the meantime, we'd urge Safari users to disable the "Open 'safe' files after downloading" option in General pane of Safari's preferences. (In fact, we've recommended disabling this option since May 2005, when a weakness involving Dashboard widgets was discovered).

<http://db.tidbits.com/article/08119>

The root of the exploit involves the way Mac OS X determines which program should launch files of a particular type. Under Mac OS 9, applications were associated with files using four-letter creator codes stored in a file's resource fork; under Mac OS X, applications are associated with file via a more arcane system involving metadata and a file's extension. By renaming a Unix shell script to a "safe" extension (like .pdf, .jpg, etc.), setting the script file's executable bit, and compressing the script with the Zip archiving utility, Safari will happily download the script, decompress it, assume the script is "safe," then blithely pass it off to the Mac OS X Terminal application for execution. An attacker could easily use such a script to delete a user's home directory, damage the computer's configuration, or obtain personal data. (For more information, see Matt Neuburg's "Of Files, Forks, and FUD" elsewhere in this issue.)

Safari is the only Web browser known to be affected, although it is possible other programs could be vulnerable to similar attacks. The Camino and Firefox Web browsers are not vulnerable to this particular exploit.

Danish security firm Secunia has listed the flaw as "extremely critical," and has posted a harmless sample exploit of the flaw so users can test if their systems are vulnerable. Heise Online has another demonstration of the exploit.

<http://secunia.com/advisories/18963>
<http://secunia.com/mac_os_x_command_execution_ vulnerability_test/>
<http://www.heise.de/security/dienste/ browsercheck/demos/safari/Heise.jpg.zip>

Users may also be able to protect themselves from the exploit by removing the Terminal application from its default location in Applications > Utilities. (However, doing so may confuse future system updaters, so users would probably have to remember to put it back before installing new software.)

By default, Safari's "Open 'safe' files after downloading" option is disabled on new Mac OS X 10.4.5 installations, so many users may be safe from this exploit by default. However, merely running Mac OS X 10.4.5 is no guarantee of safety: we've confirmed systems updated to Mac OS 10.4.5 from earlier versions may well leave Safari's "Open 'safe' files after downloading" option enabled. So, to be safe, check that the option is disabled on your system regardless of the version of Mac OS X you're using.

 

READERS LIKE YOU! Support TidBITS by becoming a member today!
Check out the perks at <http://tidbits.com/member_benefits.html>
Special thanks to Ronald Gehrmann, Marc Grujon, Karen Anderson, and
Deanne DuFresne for their generous support!