Slashdot Mirror
Friday Security Fun
rgraham writes "Apple has release a new security update for the Safari cookie bug. 'Security Update 2003-12-05 updates Safari to prevent unauthorized access to a user's cookies.' They also updated the article on how to 'Configure Directory Access to Protect Your Mac From a Malicious DHCP Server.'" We posted that the other day, but this time, pictures!
Never hand out cookies when on a Safari!
Along with this update, Steve Jobs announced today that OS 10.3.2 will include a small globe icon that will appear next to your system clock, helpfully reminding you that you have an update to install. While Jobs did acknowledge the fact that this feature has been in another operating system for years, he did point out that Apple's implementation will harness the power of Quartz Extreme to render fully three-dimensional, alpha-blended "Security Gnomes" that run around and patch your system twice a week. I'll still never Switch back though ;)
It has been suggested that even disabling Cookies won't help: http://www.securityfocus.com/archive/1/344992 As I understand it, this is because in Safari disabling cookies merely prevents creation of new cookies and not access to old ones. Therefore you should delete all cookies first.
Online & Feelin' Fine
A lot of apps use WebKit (Help, Sherlock, Safari, Mail) so it's easier to tell users to restart than to tell them to log out or to quit all those applications. A person that knows what they are doing will just force quit the installer.
Or run the update from the CLI.
Just don't allow cookies. (Yes, it seems too simple)
If by "fix" you mean "break a lot of functionality on sites" then yes, that certainly is an option.
The update needs you to reboot the computer. *sigh* Why is that? This is a web browser we're talking about.
oddly, this update isn't an update to Safari, instead, it's an update to the CoreFoundation framework!
as the name implies, CoreFoundation is the core of all your aqua apps, or at the very least, all your cocoa apps. one of the things this framework can do is let any app that uses the framework to get data from a URL, so it would make sense that the cookie handling would be there too. yeah, in this case i'd say a reboot is absolutely called for.
Don't call me back. Give me a call back. Bye. So yeah. But bye our, well, but alright we are on a shirt this chill.
The knowledgebase article for 10.2.8 and for 10.3.1.
That's why I love OmniWeb. It allows you to accept cookies, but throw them out when you quit the browser. Sure I lose such nifty "features" as not having to log into some websites but I also cut ads and whatnot of the ability to track me across sites for long periods.
Honestly, there need to be much better built-in controls on all browsers for limiting a server's access to data on your computer.
Sapere aude!
$ sudo softwareupdate -i -a
1 00
Password:
Software Update Tool
Copyright 2002-2003 Apple Computer, Inc.
Security Update 2003-12-05: 0...10...20...30...40...50...60...70...80...90...
Optimizing system performance. This may take a while...
Done.
You have installed one or more updates that requires that you restart your
computer. Please restart immediately.
You can do this with Safari as well.
'For example, not from advertisers on those sites'
So reads the third cookie option in Safari, but it's not true. You'll find '.doubleclick.net' in there all the time, and I doubt any of you are wandering over to DoubleClick to check out the action.
And any domain for a cookie beginning with a '.' means 'any URL in that domain' - and that is NOT just 'from sites you navigate to'.
...and the cookies only last for the current session.