Register Hardware

Original URL: http://www.reghardware.co.uk/2006/03/02/apple_security_update/

Apple update fixes 'critical' security bug

By John Leyden
Published Thursday 2nd March 2006 13:00 GMT

Apple released a security update (http://docs.info.apple.com/article.html?artnum=303382) on Wednesday that fixes multiple vulnerabilities, including a critical flaw in its Safari web browser that created a means for hackers to attack vulnerable systems.

The security bug meant malicious hackers could rename "safe file" extensions stored in ZIP archives, creating a way to trick users into executing malicious shell scripts. The flaw meant malicious applications could appear as a safe file type. If Mac users had left the "Open safe files after downloading" option enabled in Safari then malware would automatically be executed as soon as a user was tricked into visiting a malicious-constructed website. Security researchers produced a proof of concept demo (http://www.us-cert.gov/current/current_activity.html#safarishell) to validate their concerns about the critical flaw.

Apple's update tackles the issue by performing additional download validation so that the user is warned (in Mac OS X v10.4.5) or downloads are not automatically opened (in Mac OS X v10.3.9). The update also addresses 19 other security bugs in Mac OS X involving security flaws in Safari, the PHP Apache module and scripting environment as well as Mail and iChat security bugs, as summarised by Secunia here (http://secunia.com/advisories/19064/).

The appearance of the Safari bug, along with a brace of low to no risk worms affecting Mac OS X, spawned a lively debate between Mac fans and security vendors over the impact of the security flap, which disinterested observers judged (http://www.theregister.co.uk/2006/02/27/apple_security_threats_a_reality) to be largely academic. ®