Stephen Withers
Monday, 19 January 2009 04:11
Opinion and Analysis
Page 1 of 2
An effective workaround for the Safari RSS security issue flagged last week turns out to be more complicated than originally suggested.
Just over a week ago, Brian Mastenbrook warned of a
vulnerability he had discovered in Apple's Safari web browser.
The problem is that a malicious link (that could be delivered in a web page, an email, an instant message or in some other form) can be the vehicle for an attack that allows files to be read from the user's hard drive.
The vulnerability affects Mac OS 10.5 (but not previous versions) even if users do not use Safari's RSS capabilities.
If you are invited to open a link specifically in Safari, it's probably wise to decline.
"Users of Firefox, Camino, and Opera on Mac OS X are substantially better protected against exploitation by a malicious web page than users of Safari or OmniWeb," Mastenbrook observed.
Both Safari and OnmiWeb use the WebKit framework, which raises the question of whether the vulnerability is in Safari itself or in WebKit.
He originally suggested that using Safari's preferences to associate RSS feeds with another program such as Mail would provide protection until Apple releases a Safari update to fix the underlying problem.
But he overlooked that there are two other URL types associated with RSS feeds, namely feeds and feedsearch.
So how do you get around that? Find out on
page 2.
