help: protocol Security Hole

[bobw]

Don't Go There, GURLfriend 1.0
18 May 2004

We've just released Don't Go There, GURLfriend! 1.0 . DGTGF is an application you can use to patch away the OS X exploit found at http://bronosky.com/pub/AppleScript.htm quickly and efortlessly.
Miroku Hotei, Ollie Wagner

http://isophonic.net/

http://homepage.mac.com/olliewagner/dgtgf.dmg

[Randman]

http://www.versiontracker.com/dyn/moreinfo/macosx/23446

Comments on the app are interesting.

[Randman]

From xcl8

Patcher for Safari/Help Viewer Vulnerability? - I've not tested this personally, but MU today lists Don't go there GURLfriend! 1.0 which claims to fix the help:// exploit in Safari mentioned yesterday.

"(from http://isophonic.net/ source site)

Don't Go There, GURLfriend 1.0
18 May 2004
We've just released Don't Go There, GURLfriend! 1.0 . DGTGF is an application you can use to patch away the OS X exploit found at http://bronosky.com/pub/AppleScript.htm quickly and efortlessly."


Many (understandably) are leery of running this sort of thing however.
A MU reader posted another suggestion (similar to what was suggested yesterday as a better option that just disabling opening 'safe' files) - remapping the Help association using More Internet prefs pane to use a text editor instead.
Another reader wrote with his suggested fix:

" Hi Mike, here's a quick, and harmless (read; reversible) fix for the help autolaunch vulnerability:

First, make a Backup copy of /Library/Documentation/Help/MacHelp.help.

Next do a show contents on the original, and
find:Contents/Resources/English.lproj/shrd/OpnApp.scpt
Make the change as shown below (adding the two dashes in front of "open file completeParam of the startup disk" (This comments out that line of code, so it won't run.)

on <event helphdhp> (completeParam)
-- localizable text
set cancelBtn to "Cancel"
set errorText to "The item cannot be
opened. It may be disabled or not installed."
--end localizable text

try
tell application "Finder"
-- open file completeParam of the startup disk
end tell

on error errMsg number errNum
display dialog errorText buttons
{cancelBtn} default button 1 with icon 0
return
end try
end <event helphdhp>


Save the file.
Remove all your foreign language versions of the same help file (at the Resources level)

After doing this, the help file will still run, but will not be able to "open xyz for me"
Later on, you can replace your patched copy with the backup copy of MacHelp.help you made in step one, and apply Apple's (forthcoming) fix to it.
Meanwhile, you'll be safe from that exploit.
hth
Cordially, Tracy V. "

[Randman]

http://www.macosxhints.com/index.php

Leads the day's topic.

[Captain Code]

This isn't a hole in Safari, just how OS X handles the help:// protocol. Safari, IE, Mozilla(I think) all hand off those protocols to the OS, and the bug is in the Applescript and not any browser.

[scruffy]

Disabling the opening of 'safe' attachments will prevent an attacker from first planting a script on your computer, then executing it with the help:// protocol. It doesn't stop the attacker executing a script they already know is there.

[Captain Code]

Apparently you can use an Applescript in the Help program to execute pretty much any unix command, not just something on a dmg that you have to download and mount.

[Randman]

Unsanity today released Paranoid Android, which the company says can protect you from a serious security flaw under Mac OS X. "A vulnerability in Apple's Mac OS X results in a potential situation in which a malicious person could execute arbitrary commands on your machine, such as deleting your home directory, or doing other harmful actions," notes Unsanity. "This vulnerability involves the use of URL "schemes". These are the part of a web address that specifies what program should be used to handle the address." Paranoid Android works by watching the URL schemes that are requested and delaying them until the user has had a chance to say whether or not they would like to proceed. "Paranoid Android is completely free - we do this for the benefit of Mac community," notes the Unsanity Web site. *

Get it here.