The Mac Observer

Choose text size: Select small text. Select medium text. Select large text.

Open Source Software Engineer Reports Vulnerability in Safari RSS Feeds

January 13th, 2009 at 11:15 AM - News by Chris Barylick

In a post to his blog on Sunday, open source software engineer Brian Mastenbrook stated he's located a vulnerability in the Safari web browser for the Mac OS X and Windows operating systems that could compromise a user's files and passwords if exploited.

"Safari ... is vulnerable to an attack that allows a malicious web site to read files on a user's hard drive without user intervention," Mastenbrook wrote.  "This can be used to gain access to sensitive information stored on the user's computer, such as emails, passwords, or cookies that could be used to gain access to the user's accounts on some web sites."

Mastenbrook then advises that users change their default RSS reader preference to another feed reader, such as the one embedded in Apple's Mail program or NetNewsWire.

Where Windows users are concerned, Mastenbrook's blog entry suggests that users rely on an alternate web browser until the security hole is patched.

Though not a widely known name outside security circles, Mastenbrook is currently credited with no fewer than four mentions by name in previous security updates and fixes.

 

 

  • Related Entries
  • Email This
  • Tweet This
  • TMO on Twitter

2 Observer Comments

I wonder how soon it will before Apple has a security update for this.

   Quote    Original Workaround Not Sufficient said on January 14th, 2009 at 1:35 PM:

“The original version of this page contained a simple workaround for this issue which I believed would protect users against this problem. I have since discovered (on 13 January 2009) that changing the default RSS feed reader application in Safari does not correctly disassociate Safari from all RSS feed URLs. The workaround section of this post has been updated with additional information. I regret that what initially appeared to be a simple workaround is now substantially more complicated and requires the installation of third-party software to perform.”

Page 1 of 1 pages
Login. Need an account? Register here.



Auto-login on future visits

Show my name in the online users list

Forgot your password?

Commenting is not available in this section entry.
 

Recent Headlines - Updated July 3rd

Fri, 10:29 AM
News - Apple Warns of Learning Interchange Security Breach
7:30 AM
News - Happy Fourth of July!
Thu, 6:07 PM
TMO Scoop - Psystar Moves to Drop Bankruptcy Ahead of Apple Legal Battle
5:52 PM
In-Depth Review - Trivial Pursuit: A Solid Adaptation of a Classic Board Game
5:37 PM
News - Uncomfirmed Reports Say Apple & Nvidia On The Outs
4:57 PM
News - Microsoft Sick Over Barf Ad
4:09 PM
Product News - KRK Ships R6 Passive Studio Monitor for Recording
3:45 PM
John Martellaro's Blog - Particle Debris (week ending 7/2)  Juiced, Joost and Goosed
3:41 PM
iPhone - New iPhone Bootcamp Dates from Big Nerd Ranch Europe
3:12 PM
Product News - ExactScan 2 Pro Released
1:56 PM
Deal Brothers - Apple TV with 160GB Hard Drive:  $324.00 Delivered
1:22 PM
Quick Look Review - Wings Earth for iPhone: A Pleasant Flying Experience
 

The Mac Observer Reader Specials

Hot Topics

What's the buzz? These articles have TMO readers talking.

Top Deals From DealBrothers.com

Recent Features

Get the latest installments of TMO Columns, Podcasts, & Blogs.