Brief Hands-On Report--Apple Security Update 2004-05-24 for 10.3.3 and 10.2.8

Security Update 2004-05-24 is available via the Software Update preference pane or as stand alone updaters for 10.3.3 and 10.2.8, both client and server. They deliver a number of security enhancements and is recommended for all Macintosh users. They fix the web browser/Help Viewer vulnerability described in this Wired article.

The update includes the following components:

Security Update 2004-05-24 for Mac OS X 10.3.3 "Panther" and Mac OS X 10.3.3 Server

HelpViewer: Fixes CAN-2004-0486 to ensure that HelpViewer will only process scripts that it initiated. Credit to lixlpixel for reporting this issue.

Security Update 2004-05-24 for Mac OS X 10.2.8 "Jaguar" and Mac OS X 10.2.8 Server

HelpViewer: Fixes CAN-2004-0486 to ensure that HelpViewer will only process scripts that it initiated. Credit to lixlpixel for reporting this issue.

Terminal: Fixes CAN-2004-0485 to improve URL processing within Terminal. Credit to René Puls for reporting this issue.

It's not clear why the security update has Monday's date rather than Friday's when it was actually released. Until Apple released this security update, the two better workarounds were to use:

1. More Internet v1.1.1 preference pane by MonkeyFood.Com to redirect a web browser's "help" call to the Chess application instead of the Help Viewer; or

2. Paranoid Android 1.0 by Unsanity to look at all web browser URL calls and to manually accept or reject them.

The latter application from Unsanity seems to be a good idea for extra security in any case. More Internet replicates for Mac OS X 10.3.x the Internet Config pane of Mac OS X versions prior to Panther and is a very useful preference pane. Both are free.

Before Apple released Friday's security updates, we tried both workarounds without problem. We installed the security update on several Macs with no problem.