Safari Falls Victim to Remote Code Exploit

← Back to Stories (view on slashdot.org)

Safari Falls Victim to Remote Code Exploit

Posted by pudge on Monday May 17, 2004 @05:36AM from the the-most-important-thing-is-to-tell-people-how-to-use-the-exploit dept.

A user writes, "A new vulnerability has been found in Mac OS X's Safari, which will launch Help.app and run an arbitrary script with a URL like 'help:runscript=...', assuming a known path (which is possible when Safari is set to automount disk images (which is the default)). A nice working demonstration is available on insecure.ws while the incident has been reported on Full-Disclosure."

10 of 197 comments (clear)

Min score:

Reason:

Sort:

Wow by mcgroarty · 2004-05-17 05:40 · Score: 5, Funny

I've got to hand it to Apple...
"help:runscript=..."
No double-decode, unicode obfuscation, or CMD.EXE parms. Even the exploits are user-friendly!
That's it.. by Carlos+Silva · 2004-05-17 05:40 · Score: 5, Funny

I'm switching to Windows!
omg no by Anonymous Coward · 2004-05-17 05:43 · Score: 1, Funny

omg no!! wat wil i do?
some1 help meeeeeeee!!!!!!!

\@O@/
Good days ahead by vijaya_chandra · 2004-05-17 05:44 · Score: 5, Funny

First signs that apple's really in competition with Microsoft
HA HA HA by zulux · 2004-05-17 06:10 · Score: 4, Funny

I SO GLAD MY TRS-80 COCO ISENT
VULNERABLE TO THIS. ALL YOU PE
OPLE WITH FANCY GUI COMPUTERS
WILL REGRET IT SOME DAY.

OK
?
OK
?

(Lameness filter encountered. Post aborted!
Reason: Don't use so many caps. It's like YELLING.)

--
Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.
Re:Um, what privilidges does it run at? by Anonymous Coward · 2004-05-17 07:00 · Score: 1, Funny

Congratulations on completely missing the point.
Re:Pudge, you got it WRONG! More serious than this by Anonymous Coward · 2004-05-17 08:03 · Score: 1, Funny

> Also, MSIE allows changing it, and it is included with Mac OS X

Using MSIE to workaround an OS X security issue, imagine that!
Re:Changing the settings by Anonymous Coward · 2004-05-17 14:10 · Score: 1, Funny

I'm afraid to click on a URL containing "monkeyfood" in it in this kind of thread.
on a totally unrelated note... by ansleybean · 2004-05-17 17:44 · Score: 2, Funny

I'd like to announce the unveiling of my new website, http://www.iwilltotallyhax0ryourmac.com/evil_page. htm
Re:No,:That won't make a difference by Anonymous Coward · 2004-05-18 00:20 · Score: 1, Funny

Opera doesn't run the links...

finally a reason to use opera