Mac OS X File Association Meta Data Shell Script Execution - Another security hole found in OSX

Secunia ^ | 2/22/06 | Secunia

[Axlrose]

Michael Lehn has discovered a vulnerability in Mac OS X, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error in the processing of file association meta data in ZIP archives (stored in the "__MACOSX" folder) and mail messages (defined via the AppleDouble MIME format). This can be exploited to trick users into executing a malicious shell script renamed to a safe file extension stored in a ZIP archive or in a mail attachment.

This can also be exploited automatically via the Safari browser when visiting a malicious web site.

[Axlrose]

Yet another security headache for Mac users. Thats 3 holes found with a week.

[sarasota]

ping

[avg_freeper]

"Thats 3 holes found with a week."

No this is just a repeat of what Secunia already said.

Secunia's job is to frighten Mac users into needing a security product no one thinks they need.

[Axlrose]

Secunia Advisory: SA18963
Release Date: 2006-02-21
Last Update: 2006-02-22

???

[Mr. Blonde]

Isn't this the same one that was posted yesterday. And haven't they yet to find one in the "wild"? I thought pretty much everything so far was, yes it could happen we proved that, but it hasn't happened yet in a way that will affect anyone.

[Swordmaker]

All right here is the FIX for this OLD NEWS problem until Apple releases a patch for it... PING!

Start Safari if you aren't using it right now. Select "Preferences" under the "Safari" menu and chose "General", UNCHECK the "Open 'Safe' files after downloading" check box. Close the preferences.

Now, for total safety, create a new folder on your Macintosh Hard Drive called "Terminal Holding". Enter your Application/Utilities folder and drag the application "Terminal" from that location and drop it on your new "Terminal Holding" folder.

Now this exploit will not work and will only attempt to open the malicious file as a QuickTime movie and will fail.

If you still need to use "Terminal" it will work just fine from the "Terminal Holding" folder. IT is also a good idea NOT to be operating as an administrator. If you don't know how to change that, ask me.

If you want on or off the Mac Ping List, Freepmail me.

[Swordmaker]

I got everything above that; are you saying don't be in admin mode when you move the terminal app? (and why? I live in admin mode...)

Actually, you can't move the Terminal app unless you ARE in admin mode. The applications folder is protected from all modification by users who are not admin level users. If you attempt to move a file it will only copy, not move. You cannot add a file to Applications or delete or rename anything in it. If you want to add an app, the system will create an Applications folder in your home user folder and add the app there... which will be unavailable to any other user on that system.

My point is that for general computer YOU should be operating as a limited user without admin privileges (you can still do some admin things if you validate them by providing your admin user name and password). This is the most secure way to operate OSX.

Right now, I am using a "standard" limited account...it does not have administrator privileges... but that is transparent to me unless I attempt to install a program or modify system settings. Any apps that attempt to modify the Applications folder or change any system settings will pop up a validation requester. Some activities won't even do that... to do them you have to actually log on as an administrator account.

I use this limited account NOT because I don't trust me... but because, someday, there may be an exploit that might be able to actually penetrate Mac security but if I am not an administrator, there is a much higher bar to leap to do any damage. While protecting the system files and apps, I can still modify the look and feel of my Mac experience as much as I want (if the admin - me - allows it)... but any changes affect only THIS Account.

Changing YOUR current Administrator Account to a STANDARD (limited) Account

For those who may not know how to change your current account to a "limited" account and keep your current documents and settings, but still have the ability to administer the computer, here is how it is done:

Enter System Preferences under the Blue Apple and select "Accounts". If it is locked, unlock it by clicking on the padlock on the bottom right and providing your admin user name and password. Then click on the "+" button in the Accounts window. This will create a new user. Give it a name (Admin will do but it is a bit obvious) and then create a HARDENED password for it... use the password tool (click on the key button) and keep trying passwords that use numbers, upper and lower case, and symbols until you get the bar a nice bright green (red is bad). Make sure it is one you WILL not forget. Then click on the button that says "Allow user to administer this computer."

Now, log off your current administrator account you've been living in...

Then log back in using your new administrator account. It won't be pretty... just the basic beginning OSX screen and Dock... no pictures, nothing customized... but then you won't be living here. Go to System Preferences again and unlock it if necessary with your new account name and password. Select your old Account and UNCHECK the "Allow Account to administer this computer."

I would set the log-in Options (bottom of the Accounts Window) to allow fast user switching.

Then LOCK the Accounts preference pane.

Log off your new Administrator Account and log back in to your normal account... which will now be a limited account with all your settings and permissions (somewhat limited) and documents untouched.

Use the Administrator Account for software updates and installing new apps you want all users to have access to and to add or modify users... everything else works fine in the limited account you are used to.

Note that there is one more level in OSX above Administrator... called Root. Root is deactivated by default. Root level access is the level most Windows users live in by default... and why it is so easy to damage a Windows installation if Malware gets access to the Windows user's access level. Root can do everything including modifying or deleting the OS.

[Reborn]

bump for later read