Member Michael Lehn today reported the discovery of a security flaw in the Open "safe" files after downloading feature of Safari, also being reported by heise online. The flaw has been independantly confirmed.

When the Open "safe" files option is checked in the General tab of Safari preferences, a downloaded archive (zip file) containing a shell script named with a .jpg or .mov extension and missing the standard #!/bin/bash line can cause Safari to execute the shell script in the Terminal application without a confirmation prompt. A shell script has the privileges of the logged-in user, so in theory if a malicious script was executed this way, home folder files would be suspectible to damage. If the user was an administrator, system files and applications could be affected as well.

Two preventative measures can be used to avoid the flaw: (1) Disabling the Open "safe" files after downloading feature in Safari preferences. (2) Moving the Terminal application out of its normal location in the Applications/Utilities folder. The former method may be inconvenient during other routine downloads, while the latter may need to be reversed while performing Mac OS X updates.

The problem does not apply to other commonly used web browsers.

So far, a demonstration (proof of concept) download has been created, but no real exploits are known to exist. The problem has been reported to Apple Computer.

[Update] CNET reports that Apple is developing a patch for this security flaw, quoting an Apple representative as saying "We're working on a fix so that this doesn't become something that could affect customers" but without giving a delivery date for an update. Because the problem can reportedly affect Mail as well as Safari, the update may come in the form of changes to Mac OS X, not to Safari alone.

Popular Stories

Apple WWDC23 macOS Sonoma hero

macOS Sonoma Launching This Week With These New Features

Sunday September 24, 2023 12:45 pm PDT by
Apple previously announced that macOS Sonoma will be released this Tuesday, September 26. The free software update includes many new features and changes for the Mac, including the five that we have highlighted below. In addition to these five features, we have shared the full release notes for macOS Sonoma below for a complete overview of everything new. Desktop Widgets macOS Sonoma...
iPhone 16 Mock Header With Dynamic Island

Skipping the iPhone 15 Pro? Here's What's Rumored for iPhone 16 Pro

Friday September 22, 2023 9:29 am PDT by
Are you skipping the iPhone 15 Pro and waiting another year to upgrade? If so, we already have some iPhone 16 Pro rumors for you. Below, we recap new features rumored for the iPhone 16 Pro models so far:Larger displays: The iPhone 16 Pro and iPhone 16 Pro Max will be equipped with larger 6.3-inch and 6.9-inch displays, respectively, according to Ross Young, CEO of Display Supply Chain...
iPhone 16 Side Feature

iPhone 16 to Include an Additional Capacitive 'Capture' Button

Monday September 25, 2023 12:50 pm PDT by
The iPhone 16 series is expected to gain an additional capacitive button, known internally as the "Capture Button." Codenamed "Project Nova," the button is likely to be one of the main selling points of the iPhone 16 lineup, assuming it gets past the initial testing phase. The Capture Button is located on the same side as the Power button, only positioned slightly lower - where the mmWave cutout...
ipad mini blue

Apple to Launch iPad Mini 7 Later This Year, Industry Report Suggests

Monday September 25, 2023 3:16 am PDT by
Apple could be preparing to release a seventh-generation iPad mini before the end of the year, based on a new report by DigiTimes. In an article discussing stagnating global tablet demand in the second half of 2023, the Taiwan-based outlet forecasts an uptick in Apple's share of the market owing to orders for a "small-size" iPad in the fourth quarter. From the report (see bold): In the...