Apple Safari Browser Automatically Executes Shell Scripts

[Marsden11]

Shortly after reports of the first virus for Mac OS X, a new security flaw has surfaced. The culprit is the option "Open 'safe' files after downloading" in Apple's Safari web browser. This feature is activated by default. Its function is to automatically display images and movies after they are transmitted to the user's computer, using the application assigned to that particular document format. Safari will also unpack ZIP archives and display the documents within if they are considered "safe". If active content such as an application or shell script is found within the archive, a prompt requests user confirmation. So far, so good. Problems ensue if a shell script is stored into a ZIP archive without the so-called shebang line. If this line is omitted, Safari no longer recognizes the content as potentially dangerous and executes shell commands without a confirmation prompt. This behavior has been discovered by Michael Lehn, who has documented it on a web site.Under normal circumstances, shell scripts begin with a "shebang line" such as "#!/bin/bash" to indicate which interpreter should handle its execution. However, Mac OS X will load scripts without a shebang line into the Terminal where it will be executed by a shell. If the user has assigned the Finder to open scripts using the Terminal, this will happen automatically.If a script is given an extension such as "jpg" or "mov" and stored within a ZIP archive, Mac OS X will add a binary metadata file to the archive which determines its association. This metafile instructs the operating system on another Mac to open that file with the Terminal application -- regardless of its extension or the symbol displayed in the Finder. The Terminal will redirect scripts without an interpreter line directly to bash, the standard shell in OS X.The best immediate recourse against such an attack is to deactivate the option "Open 'safe' files after downloading" in the "General" section of Safari's preferences. Alternative web browsers such as Camino or Firefox do not support the automatic execution of files. These browsers can be prompted to automatically download a file by using the refresh command in the HTML source code of a web page. However, the file will not be executed. Since the Finder selects the icon for a file based on its extension, users are advised to verify that the OS is using the proper file type. This can be done through the information window or in column view.An additional protective measure is to move the Terminal application from /Applications/Utilities into a different folder. The metadata file within the ZIP archives always contains absolute paths to the applications to be used for opening its contents. To avoid problems with system updates which update the Terminal, the application should be moved back to its original location before updating the OS. In addition, users should not use their administrator account.You can determine whether your system is vulnerable by using this online demonstration provided by heise Security. The demo attempts to open a Terminal window to display the contents of a folder. If you are running Mac OS X in its standard configuration and use Safari, the window will open without waiting for a prompt. The script could just as well delete all files accessible to the current user. At this point, no web pages are known to misuse this vulnerability. However, this could change quickly. (ghi/c't) View source:

[Guest LilBambi]

Secunia.com also has this Extremely Critical issue listed and a page to test your Mac:

Description:Michael Lehn has discovered a vulnerability in Mac OS X, which can be exploited by malicious people to compromise a user's system.The vulnerability is caused due to an error in the processing of file association meta data in ZIP archives (stored in the "__MACOSX" folder) and mail messages (defined via the AppleDouble MIME format). This can be exploited to trick users into executing a malicious shell script renamed to a safe file extension stored in a ZIP archive or in a mail attachment.This can also be exploited automatically via the Safari browser when visiting a malicious web site.Secunia has constructed a test, which can be used to check if your system is affected by this issue:http://secunia.com/mac_os_x_command_execut...erability_test/The vulnerability has been confirmed on a fully patched system with Safari 2.0.3 (417.8), Mail 2.0.5 (746/746.2), and Mac OS X 10.4.5.Solution:Do not open files in archives or mail attachments originating from untrusted sources.The vulnerability can be mitigated by disabling the "Open safe files after downloading" option in Safari.Provided and/or discovered by:Michael Lehn

Further, in the SANS.org NewsBites and has some additional article links as well:

Editors Note (Paller, with guest editors Brian Caswell of SourceFire,Jeff Plum of MedData and Brian Goldberg of Carbonite Labs):Attacks have been seen; Macs are now being infected. They get infected just by visiting an infected web site. To find out whether your system is vulnerable, use the test at Secunia:http://secunia.com/mac_os_x_command_execut...erability_test/ To remove the vulnerability from your Mac, until Apple fixes the problem, is to disable "Open safe files after downloading" option in the Safari Browser.