[codey (old)]

A pretty nasty security hole has been discovered in OSX when using any browser. Apple Help is allowed run applications and thus it is possible to make a file download and run within Help by simply clicking a weblink. Which opens up to various nasty things if some script kiddie decides to be 'funny'. But there are fixes until Apple patch this.

The quick and dirty one for Safari is simply in Preferences>General turn off 'Open "safe" files after downloading'. That way nothing runs until you double click on the file. Which of course requires the user not doing it if a unknown help file has been downloaded.

The second trick is to set url helpfiles to open with another app than Apple Help such as TextEdit. This cannot been done easily directly in OSX but there are two freeware apps out that can be used for it. The advantage of this is that it works for all browsers, not just Safari.

http://www.monkeyfoo...e/moreInternet/

http://www.clauss-ne...fox/misfox.html

After installing and launching find 'help' in the list and then set TextEdit as default application. This only change how linked helpfiles behave, not those in the help menu.

The really rough fix is to rename the entire help folder in Library but that's really harsh as that will disable all Help on the system and not really necessary.

Details about the exploit can be found here

http://secunia.com/advisories/11622/

Some more info here

http://www.jayallen....l_security_flaw

and the mandatory geek trash talk about it here

the epicenter of geekdome

cheers

[codey (old)]

The nice chaps at Unsanity have made another fix for it, also freeware. Here the read-me explanation:

Paranoid Android can protect you from this potential vulnerability until Apple makes an official fix available. It does this by watching the URL schemes that are requested and delaying them until you've had a chance to say whether you'd like to proceed or not. If you know that the url that's being loaded is legit, go ahead, but if it looks suspicious, Paranoid Android gives you an opportunity to cancel it.

And here's the link:

Paranoid Android

cheers