Mac OS X hit with another security hole

Another "highly critical" hole has been found in Apple Computer's Mac OS X operating system, which will allow remote system...

Another "highly critical" hole has been found in Apple Computer's Mac OS X operating system, which will allow remote system access by getting someone to visit a malicious website.

The vulnerability deals with how basic internet elements are addressed in the OS' help facility which allow arbitrary local scripts to be executed on a user's machine.

It is also possible to place files in a known location on a system by asking users to download a ".dmg" disc image file. A default browser option in Explorer and Safari will mean a single user click is enough to drive the whole process.

The combination of the two holes, tested and confirmed by security experts Secunia, can allow system access to be achieved "very simply", said Secunia chief technology officer Thomas Kristensen. The holes affect Safari 1.x and Explorer 5.x.

The solution is to change browser options and rename the help URI handler, Kristensen said.

In the past fortnight, controversy has reigned over security vulnerabilities in the Mac OS, with three security companies accusing Apple of downplaying significant security holes twice and leaving their customers at risk of compromise.

However, many of its loyal users have pointed out the lack of viruses and hacking tools which security holes in Windows tend to generate as evidence that there is no real security issue.

The appearance of a malicious file last week that purported to be a Word 2004 for Mac demo which wiped out a user's Home folder, put that assumption under question.

Apple argued that the file was not a virus since it was not self-propagating and has continued to dismiss security concerns.

It is this behaviour, and the company's failure to make its customers aware of such issues, that has led some security companies to despair of what they see as foolish complacency. 

"It is our sincere hope that the supplier will make an earnest effort to increase the maturity of its security response capabilities, so that researchers will be encouraged to continue to work with them amicably on future security issues," said eEye Digital Security. 

"Apple is doing a disservice to its customers by incorrectly labelling this vulnerability as a 'crash bug' rather than stating correctly that attackers can compromise systems running the affected Apple software," it added.

Keiren McCarthy writes for

Read more on IT risk management