X

Odds and Ends: Safari vulnerability (with .ZIP files) revisited; QPS out of commission; more

Odds and Ends: Safari vulnerability (with .ZIP files) revisited; QPS out of commission; more

CNET staff
2 min read

Safari vulnerability revisited An article on Heise Online revisits a security issues previously discussed on MacFixIt where potentially malicious code may be executed if the "Open 'safe' files after downloading" in the "General" section of Safari's preferences is turned on.

The article states:

"This feature is activated by default. Its function is to automatically display images and movies after they are transmitted to the user's computer, using the application assigned to that particular document format. Safari will also unpack ZIP archives and display the documents within if they are considered "safe". If active content such as an application or shell script is found within the archive, a prompt requests user confirmation. So far, so good.

"Problems ensue if a shell script is stored into a ZIP archive without the so-called shebang line. If this line is omitted, Safari no longer recognizes the content as potentially dangerous and executes shell commands without a confirmation prompt. [...]

"If a script is given an extension such as "jpg" or "mov" and stored within a ZIP archive, Mac OS X will add a binary metadata file to the archive which determines its association. This metafile instructs the operating system on another Mac to open that file with the Terminal application -- regardless of its extension or the symbol displayed in the Finder. The Terminal will redirect scripts without an interpreter line directly to bash, the standard shell in OS X." More.

QPS out of commission MacFixIt reader Dan Cole reports that drive manufacturer QPS is, for all intents and purposes, defunct.

Dan writes:

"I was finally able to get a hold of QPS Tech support last week and they conformed that they are no longer in the drive business and they will not be supporting the QPS drive products. So unless someone comes up with a new driver, my QPS product is a boat anchor."

Knowledge Base updates:

  • #303311 iWeb: Unable to publish an image over a movie
  • #303139 iDVD 6: Photos are missing from iDVD project after upgrading
  • #61145 How to turn on iPod's backlight
  • #303249 Apple USB Modem: System Requirements
  • #25633 Mac OS X 10.3: Chart of available Mac OS software updates

Resources

  • More.
  • #303311
  • #303139
  • #61145
  • #303249
  • #25633
  • More from Odds and Ends: