Two Mac OS flaws have been identified this week. First is a worm called OSX.Inqtana.A, which spreads through a vulnerability in OS X via Bluetooth. The worm attempts to use Bluetooth connections to spread by searching for other devices using Bluetooth that will accept requests for a connection when the computer is restarted. Its specific name is the BlueTooth Directory Traversal Vulnerability. Up-to-date virus definitions and current system updates will address this flaw as well as generally following safe computing practices. This is a low threat level, according to Symantec Anti-Virus.
Safari Security Alert (February 21, 2006)
Another flaw has been discovered that could allow an attacker to execute malicious code on a Mac OS X machine. The flaw is not actually a software bug, but rather an insecure default setting in Apple's Safari web browser. This vulnerability does not occur in alternate web browsers such as Firefox or Camino because neither browser supports automatic execution of files by default as does Safari.
By default, Safari is configured to automatically open what it considers to be "safe" files. Some of these "safe" files, though, have the potential to be "unsafe". It's been shown that an attacker could essentially encapsulate malicious code into a file that appears to be one of the "safe" file types (such as a image or audio file). Upon download, the file would be opened and the code executed. Please note that, at this time, no specific exploits have been reported, but there are still steps that should be taken to protect your system. |
