Brian Mastenbrook didn't get specific in a blog entry posted Sunday, but he did claim his discovery has already been acknowledged by Apple. All users of Mac OS X 10.5 Leopard are affected, whether they use RSS feeds or not, as long as they have not changed their preference from the default, as seen below.
"Safari ... is vulnerable to an attack that allows a malicious web site to read files on a user's hard drive without user intervention," Mastenbrook wrote. "This can be used to gain access to sensitive information stored on the user's computer, such as emails, passwords, or cookies that could be used to gain access to the user's accounts on some web sites."
According to Mastenbrook, Mac OS X Leopard users should change their Default RSS reader preference to another feed reader. Possible solutions include Mail and NetNewsWire.
Safari for Windows users should use a different web browser until the security hole is patched, he said.
10 Comments
Just goes to show that ALL software has the potential of being compromised. Windows, Mac OS, Linux, whatever...
For all Safari users, I hope Apple releases a quick fix.
What's funny is that RSS used to be this huge thing back in like 2003. I never got into it, I simply visit a specific list of bookmarks each day. Maybe that's old school, but I guess its "more secure".
Well, if we're suggesting other RSS viewers/readers, let me put in a plug for Vienna. Switched to it a couple of years ago and never looked back. It's free, specific to the Mac, and open source. So open that I've even mucked around with how it displays the feed items a bit to meet my preferences.
http://www.vienna-rss.org/
That said, it's certainly possible that other readers have their own security flaws.
I use reader.google.com
Works great.
Well, if we're suggesting other RSS viewers/readers, let me put in a plug for Vienna. Switched to it a couple of years ago and never looked back. It's free, specific to the Mac, and open source. So open that I've even mucked around with how it displays the feed items a bit to meet my preferences.
http://www.vienna-rss.org/
That said, it's certainly possible that other readers have their own security flaws.
I'm just sticking with Safari as my RSS reader. I don't plan on crawling under my bed in fear.