Mac OS X vulnerable to one-two combo attack

TalkBack 7 of 38:

Next »

« Previous

• Thread View
• Flat View

This "should" not be effected by root priveledges

The exploit says that a user could be tricked into
downloading malicious code and running it. That code
could be one of many things - many of which would not
need root privelege - say somthing like opening an
application and then doing something in that app - NOT
requiring any root privelege

If one were concerned about this you can open Safari
preferences and uncheck "Open safe files after
downloading". That would prevent the thingfrom running
and would simply put it in your selected download folder.

It can be prevented in IE by adding a dmg mime and file
type abd selecting save to folder, rather than selecting a
helper app to open it.

You must remember that this is all very theoretical
beccause it requires a website to lure a viewer and then
download a DMG.

I would think that the permanent solution would be for
Apple to remove the ability of Safari to automatically
decompress dmg file and run an installer script. That is a
big weakness of the application.

Safari's big advantage is its speed and faithfulness in
rendering. Its weakness is that it does not allow as many
preference selections as other browsers. IE's big weakness
on the Mac is that it's incredibly slow compared to the
competition and can do some really lousy rendering,
depending on the website. Mozilla is fast and faithful. It's
also the "safest" out of the box because it does not have
any helper apps configured. that's a big weakness for
people who do not know how to set the preferences to call
helper apps (probably the majority of users)

Posted by: j.m.galvin   Posted on: 05/19/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now