Safari, IE flaw could allow malicious code execution

By Jim Dalrymple

May 18, 2004 12:00 PM ET

Recommended

(4)

Digg

Twitter

Share/Email

Macworld - In what is being described as a "highly critical" vulnerability, security firm Secunia on yesterday issued an advisory to all Mac OS X users that surf the Web with Microsoft Corp.'s Internet Explorer or Apple Computer Inc.'s Safari Web browsers.

The vulnerability, which was first reported by lixlpixel and confirmed by Secunia, takes advantage of the "help" URI handler and "allows execution of arbitrary local scripts (.scpt) via the classic directory traversal character sequence using 'help:runscript.'"

The result of the vulnerability, which has been confirmed using Safari 1.2.1 (v125.1) and Internet Explorer 5.2, is that it is "possible to place arbitrary files in a known location, including script files, on a user's system if the Safari browser has been configured to ("Open "safe" files after download") (default behavior) by asking a user to download a ".dmg" (disk image) file."

Secunia recommends opening Safari preferences and uncheck "Open 'safe' files after download.

Reprinted with permission from

For more Macintosh news, visit Macworld.com.
Story copyright 2009 Mac Publishing, LLC. All rights reserved.

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Jump to comments

Macintosh

Additional Resources

Xerox

Win a color printer!

By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!

Microsoft

Upgrade to Internet Explorer 8 today.

Save time and mitigate security risk. Deploy it now.

Sybase

NEXT-GENERATION MOBILITY PLATFORMS

In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.