… a serious vulnerability has been found in Apple Safari on OS X. “In its default configuration shell commands are execute[d] simply by visting a web site – no user interaction required.” This could be really bad. Attackers can run shell scripts on your computer remotely just by visiting a malicious website.
Full text of the article: http://www.heise.de/english/newsticker/news/69862
Proof of concept from the original discoverer (Michael Lehn): http://www.mathematik.uni-ulm.de/~lehn/mac.html
The problem is due to a feature that is activated by default: Open Safe Files after downloading. A zip file is considered safe and so they will be opened automatically. Subsequently, a shell script with no #! at the beginning of the script will be executed automatically. No user interaction!
[[T_F]]Digital Content Theft Prevention and Tracing, Downloads and Online Property Protectiontracefusion_signature=d41e044552eb97617265603499d60e07fbe9937f2c69f47a48363e83a2a57292a2efc077c7666ad2ce23a86fea8c934f9fef856c68606f51fa66ca64d7cc694c063510af12be9fefe9994075cc7219cb06a84241bcc2b9706e49c4f7f527d868cb81092f3cf2162a1f5d2aea7921091c125fc8aaaa3676d2a40e0a5cbd2b0e1cbba43878c24eaa6c03615d4cb0ebbbe5ed3257f457690e9cd73e8f6059ed4183714b15d4c60308b723ede679e2570ab495b40b030f7d81e8583780895c5898d1ff3608f638b84cac5234fc9e0512ee0d484cdfde97ec5a394c26b0d4135888181307e3abfad9009f696974b64acc41d9e74a8e6ee491eb797ad22a1874ecd7a4d7829a2fa91d21c1df7f0286051f04d065a90e21392c0137cfcb14754b76c258044783ba5e2d9b5b69b5e77ccaa336e3da2ddaeafb301e69061f07417b3641d373d7dc21db09dbedfd717e04e20479910acb085e89c4b02958d01d275527b944f719e314eb095d3ebcb15de9b753da287c0b24531f17f17f264752395749efdf48d2a8cde068d864cc3980fb5acee941533b59258070235687925a310467baaa045c26b349b4055b5c798820e2623e8b1a198b312ed579c1d03196d6dcca7fed1aca7fecdb[[T_F]]
