Help Viewer/browser security vulnerability (#3): Terminal fix; Opera immune
Continuing our coverage of a potential vulnerability in OS X relating to browsers' use of the help URL protocol (exploitable through any browser that properly supports URLs that include the "help" protocol), there is a new fix that can be applied via the Terminal that does not require disabling/redirecting the Help protocol (as our previous fix entailed) as well as word that the Web browser Opera is immune to the vulnerability.
Terminal-disabled automatic launching This command changes the internal .plist for Help Viewer so that the preference for automatically launching scripts is now "no". Note that you should also disables Safari's "auto open safe files" preference (in the "General" pane of Safari's preferences).
The Terminal command is (one line, spaces after "sudo" "defaults" "write" "" "Info" "Enabled" and "-bool"):
sudo defaults write '/System/Library/CoreServices/Help Viewer.app/Contents/Info' NSAppleScriptEnabled -bool 'no'
[NOTE: A quirk in our publishing system causes the escape character "" (which should be between 'Help' and 'Viewer.app' to be omitted from the above Terminal command when appearing on the main MacFixIt page, causing Terminal to return the error "Unexpected argument -bool; leaving defaults unchanged" when entered. We've changed the command to quote the filename path instead of using the escape character, so it should work properly now.]
Opera immune Several readers have noted that they cannot reproduce produce the exploit browsing with Opera, because it does not support the "help:" protocol, as noted on the opera.mac news-group:
One reader wrote " I tried the demo page http://bronosky.com/pub/AppleScript.htm> with Opera and only got an error message 'The address type is unknown or unsupported.' So far so good?"
Opera developer Rijk van Geijtenbeek" subsequently responded: "Yes :) MacOpera doesn't support the Mac 'help:' scheme. It might be possible to enable it (if you dare) from 'Preferences > Programs and paths'. There is a reason why Opera (on any platform) doesn't enable by deafult passing random strings to the operating system for any registered scheme like 'irc:' or 'rtsp:' or 'edk:' or 'mms:' etc."
Resources
:%20Terminal%20fix;%20Opera%20immune%20%7C%20MacFixIt%20-%20CNET%20Reviews&srcUrl=http://reviews.cnet.com/8301-13727_7-10344222-263.html){kind=small}
Repair Disk Permissions in order for help to launch. If not the program fails to
launch even for the keyboard shortcut command-shift-?.
i get a -bool unknown, unchanged when i input the info from the web page. am i doing some thing wrong?
this iswhat i ran in terminal :
<p>sudo defaults write /System/Library/CoreServices/Help Viewer.app/Contents/Info NSAppleScriptEnabled -bool 'no'</p>
You need to account for the space in the name Help Viewer. Either put the
entire path and name in quotes, or escape the space.
Either
sudo defaults write "/System/Library/CoreServices/Help Viewer.app/
Contents/Info" NSAppleScriptEnabled -bool 'no'
or
sudo defaults write /System/Library/CoreServices/Help\ Viewer.app/
Contents/Info NSAppleScriptEnabled -bool 'no'
'Help Viewer.app' has a space in its name, so the full path should be quoted,
or the space escaped.
Use the following command in Terminal (should be one continuous line; be
careful about the extra characters that copying from Safari might tack onto
the end):
sudo defaults write '/System/Library/CoreServices/Help Viewer.app/
Contents/Info' NSAppleScriptEnabled 0
Hope this helps....
sudo defaults write /System/Library/CoreServices/Help\ Viewer.app/
Contents/Info NSAppleScriptEnabled -bool 'false'
sudo chmod 644 /System/Library/CoreServices/Help\ Viewer.app/Contents/
Info.plist
(hopefully nothing gets messed up in the formatting)
The first command sets the value of the key NSAppleScriptEnabled in the Help
Viewer.app's Info.plist file to 'false' (which IMHO is more correct that 'no') and
the second command fixes the permissions on the file (since the 'defaults'
command changes them to 600)
Let's try that again with HTML formatting to keep the lines from breaking:
<pre>
sudo defaults write /System/Library/CoreServices/Help Viewer.app/Contents/Info NSAppleScriptEnabled -bool 'false'
sudo chmod 644 /System/Library/CoreServices/Help Viewer.app/Contents/Info.plist
</pre>
WHAT THE HECK IS THAT BRONOWSKY PAGE ABOUT. IT CAUSED TERMINAL TO
OPEN AND A LONG LIST OF STUFF APPEARED. WAS SOMETHING DAMAGED.
http://bronosky.com/pub/AppleScript.htm
A WHOLE BUNCH OF MY APPLICATIONS AND THEIR FILES APPEARS ON THE
TERMINAL LIST. WHAT GIVES WITH THIS?
---
iMac G4, 17", 1GHz,
OS 10.3.2, 768 MB RAM
- by guy.hemmings May 24, 2004 3:54 AM PDT
- To remove risk to my Mac, can I not simply delete the Terminal
- Like this Reply to this comment
-
(9 Comments)app. as it is not normally needed for basic users? Is it necessary to have
it continuously available? If not, it could be loaded from other media
when needed...
Guy