There's nothing we love more than a good security vulnerability. It just goes to remind you once again that the only truly secure computer is that old SE/30 in your basement that's not even plugged in and is kept under lock and key.

Programmer Brian Mastenbrook identified the flaw, which affects any Mac user who hasn't changed the default option for RSS reader in Safari's preferences (that default reader being, naturally, Safari itself). The vulnerability could allow a Web site to read data stored on the user's computer, including sensitive information like logins and passwords, without notifying the user. The flaw is far-reaching, affecting both Mac and Windows users running Safari, as well as Mac users who use other browsers like Firefox but still haven't changed Safari's RSS preferences.

In terms of a workaround, Windows Safari users should switch to another browser until the problem is fixed; Mac users should just switch the default RSS reader from Safari in Safari's Preferences -> RSS panel. Apple has acknowledged the vulnerability, but there's no news on when a patch might be forthcoming. Thus far it seems as though knowledge of the flaw's details is not yet public, so there's no need for panic, but taking precautions is always good.

[via Daring Fireball]

» posted by ITworld staff

Macworld

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine