Downloads Can Automatically Execute on IE 5.1 for Mac OS X New

A security vulnerability exists in Internet Explorer 5.1 for the Macintosh OS X operating system that could allow a downloaded application to automatically execute on completion of the transfer.

Issue

The Macintosh OS X Operating System provides built-in support for both BinHex and MacBinary file types. These file types allow for the efficient transfer of information across networks by allowing information to be compressed by the sender and then decompressed by the recipient. This capability is particularly useful on the Internet, by allowing users to dowload compressed files.

A vulnerability results because of a flaw in the way Mac OS X and Mac IE 5.1 interoperate when BinHex and MacBinary file types are downloaded. As a result, an application that is downloaded in either of these formats can execute automatically once the download is complete.

A user would first have to choose to download a file and allow the download to fully complete before the application could execute. Also, users can choose to disable the automatic decoding of both these file types.

Affected Products

• Microsoft Internet Explorer 5.1 for the Macintosh

Download

Patch: http://www.apple.com/macosx/upgrade/softwareupdates.html

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: October 23, 2001

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<