Thoughtful, detailed coverage of the Mac, iPhone, and iPad, plus the best-selling Take Control ebooks.

 

 

Pick an apple! 
 
ChronoSync Secret Menubar Shortcut

For a quick way to run a ChronoSync document without opening it, use the ChronoSync menu in the menubar. Select "Show ChronoSync menu in menubar" in ChronoSync's General Preferences window to activate the menu bar menu. Once activated, you'll see the ChronoSync circling arrows icon in the menu bar, at the top right of your screen.

You can open any scheduled ChronoSync document directly from the menu bar. If you hold down the Option key while selecting a ChronoSync document, the synchronization will run immediately without the ChronoSync document opening.

Visit Econ Technologies

 
 

Significant Safari Exploit Discovered

Send Article to a Friend

A potentially critical security flaw has been uncovered in Apple's Safari Web browser, which may enable attackers to execute arbitrary Unix shell scripts on a user's machine simply by following a link on a Web site. Apple has yet to comment or release a patch, but in the meantime, we'd urge Safari users to disable the "Open 'safe' files after downloading" option in General pane of Safari's preferences. (In fact, we've recommended disabling this option since May 2005, when a weakness involving Dashboard widgets was discovered).

<http://db.tidbits.com/article/08119>

The root of the exploit involves the way Mac OS X determines which program should launch files of a particular type. Under Mac OS 9, applications were associated with files using four-letter creator codes stored in a file's resource fork; under Mac OS X, applications are associated with file via a more arcane system involving metadata and a file's extension. By renaming a Unix shell script to a "safe" extension (like .pdf, .jpg, etc.), setting the script file's executable bit, and compressing the script with the Zip archiving utility, Safari will happily download the script, decompress it, assume the script is "safe," then blithely pass it off to the Mac OS X Terminal application for execution. An attacker could easily use such a script to delete a user's home directory, damage the computer's configuration, or obtain personal data. (For more information, see Matt Neuburg's "Of Files, Forks, and FUD" elsewhere in this issue.)

Safari is the only Web browser known to be affected, although it is possible other programs could be vulnerable to similar attacks. The Camino and Firefox Web browsers are not vulnerable to this particular exploit.

Danish security firm Secunia has listed the flaw as "extremely critical," and has posted a harmless sample exploit of the flaw so users can test if their systems are vulnerable. Heise Online has another demonstration of the exploit.

<http://secunia.com/advisories/18963>
<http://secunia.com/mac_os_x_command_execution_ vulnerability_test/>
<http://www.heise.de/security/dienste/ browsercheck/demos/safari/Heise.jpg.zip>

Users may also be able to protect themselves from the exploit by removing the Terminal application from its default location in Applications > Utilities. (However, doing so may confuse future system updaters, so users would probably have to remember to put it back before installing new software.)

By default, Safari's "Open 'safe' files after downloading" option is disabled on new Mac OS X 10.4.5 installations, so many users may be safe from this exploit by default. However, merely running Mac OS X 10.4.5 is no guarantee of safety: we've confirmed systems updated to Mac OS 10.4.5 from earlier versions may well leave Safari's "Open 'safe' files after downloading" option enabled. So, to be safe, check that the option is disabled on your system regardless of the version of Mac OS X you're using.

 

New for iOS 8: TextExpander 3 with custom keyboard.
Set up short abbreviations which expand to larger bits of text,
such as "Tx" for "TextExpander". With the new custom keyboard,
you can expand abbreviations in any app, including Safari and
Mail. <http://smle.us/tetouch3-tb>