Slashdot Mirror
Huge security hole in Internet Explorer for MacOS
Brad Lucier writes "Macintouch
is reporting
(go down the page a bit)
that Internet Explorer 5.1, which comes preinstalled on MacOS X 10.1,
has a huge security hole---when it downloads arbitrary programs encoded
in the Macintosh's standard BinHex (.hqx) format, it automatically
executes them. " Well I guess thats one way to make Unix insecure. Can anyone actually confirm this since it looks kinda sketchy. I wonder what someone's rationale would be for that:"Oh this won't hurt anyone, and saving that extra 'OK' click will be great!".
Brilliant. That sort of decision runs by whole teams, I would imagine. Why doesn't anyone speak up? I would imagine that folks on the apple side saw that, also.
yeah you beat me to the punch but that was pretty much exactly what i was thinking...
"how come something that can be changed with two simple radio button clicks is being broadcast as a gapeing titanic scale hole in Max OS 10.1 security..."
Had i posted it first though, i would have tossed in some. "For Shame!" as well, especially after reading all the kneejerk anti-Mac anti-BSD trolls and their retarded comments.
good call, good post.
No, they wont. When its a problem with Windows, or Microsoft software running on Windows, its reported as a general computer problem. This is a problem with Macintosh. Im sure that the media will point that out very specifically.
Liberty in your lifetime
In the preference options, under download options, there is a checkbox for opening binhex, and macbinary files automatically. If you are really concerned about it, turn it off.
It does not deserve a 0
For a full list of replacements for Internet Explorer on any computer system, check out the Internet Explorer listing on MSBC's The Alternative. It's worth a read to see just how many IE replacements are available, quite a few of them for Macs.
== Paul Rickard, Editor of The Microsoft Boycott Campaign ====
We tried this on my friends G3 Pismo with MacOS X 10.1 and MacOS 9.2.1 installed. Clicking on the danger link from the site, IE downloaded the file. It then was automatically extracted. Classic then started up and tried to run the program. This locked up Classic but we were able to force quit the danger app and shutdown Classic.
This was with a default install of Internet Explorer on 10.1. NO PREFERENCES were changed.
This is very scary indeed!!
Under IE5.1 Final for OS X, go into it's preferences. Under the Recieving Files catagory, choose Download Options. There's 2 checked items by default. 'Automatically decode BinHex' and 'Automatically decode MacBinary'. Uncheck them both and hit ok. IE will now send those files over to Stuffit Expander, like it should. Easy, isn't it?
-Henry
"Useless organic meatbag" -HK-47
You can turn off the automatic decoding of bin.hex files ...
But why the HELL was it on by DEFAULT?
Oh, right.
It's a Microsoft program.
Never mind.
(The fact that it's for use on a non-Microsoft platform, and thus could make that platform vulnerable to malicious cracking, probably wasn't even a factor.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Yes, and IIS is an option in Windows 2000 that can be easily turned off.
/ME checks his Apache logs.
Looks like most people are not aware of that either.
Liberty in your lifetime
Root may be the owner of the file, but that does not mean root owns the process when TruBlue is launched. Classic is just another application, and not a system function. As an app, the only way it gets root power is if a password is entered by an administrative user.