Brief Hands-On Report--Apple Security Update 2004-06-07 for Mac OS X 10.3.4 and 10.2.8, Client and Server,
DiskImages
LaunchServices
Safari
Terminal
Mac OS X will now present an approval alert when an application is to be run for the first time either by opening a document or clicking on a URL related to the application.
Here are the details for APPLE-SA-2004-06-07 Security Update 2004-06-07:
Description: Security Update 2004-06-07 delivers a number of security enhancements and is recommended for all Macintosh users. The purpose of this update is to increase security by alerting you when opening an application for the first time via document mappings or a web address (URL). For more details, including a description of the new alert dialog box, please see this Apple web page.
Versions: Security Update 2004-06-07 is available for the following system versions (direct download links):
* Mac OS X v10.3.4 "Panther"
* Mac OS X Server v10.3.4 "Panther"
* Mac OS X v10.2.8 "Jaguar"
* Mac OS X Server v10.2.8 "Jaguar"
The following components are updated:
Component: LaunchServices
CVE-ID: CAN-2004-0538
Impact: LaunchServices automatically registers applications, which could be used to cause the system to run unexpected applications.
Discussion: LaunchServices is a system component that discovers and opens applications. This system component has been modified to only open applications that have previously been explicitly run on the system. Attempts to run an application that has not previously been explicitly run will result in a user alert.
Component: DiskImageMounter
CVE-ID: No CVE ID has been reserved as this is only an
additional preventative measure.
Impact: The disk:// URI type mounts an anonymous remote file system using the http protocol.
Discussion: The registration of the disk:// URI type is removed from the system as a preventative measure against attempts to automatically mount remote disk image file systems.
Component: Safari
CVE-ID: CAN-2004-0539
Impact: The "Show in Finder" button would open certain downloaded files, in some cases executing downloaded applications.
Discussion: The "Show in Finder" button will now reveal files in a Finder window and will no longer attempt to open them. This modification is only available for Mac OS X v10.3.4 "Panther" and Mac OS X Server v10.3.4 "Panther" systems as the issue does not apply to Mac OS X v10.2.8 "Jaguar" or Mac OS X Server v10.2.8 "Jaguar".Component: Terminal
CVE-ID: Not applicable
Impact: Attempts to use a telnet:// URI with an alternate port number fail.
Discussion: A modification has been made to allow the specification of an alternate port number in a telnet:// URI. This restores functionality that was removed with the recent fix for CAN-2004-0485.
We downloaded and installed Security Update 2004-06-07 on a number of Macs, including a G4 Cube and a 17" PowerBook G4 with no problems. [Dana Baggett]
Apple Introduced AirPort Express with AirTunes: Connect to the internet, print and stream iTunes all wirelessly with Apple's new AirPort Express. With it you can enjoy your iTunes music library in virtually any room of your house, share a single broadband Internet connection at a fast 802.11g speed and USB printer without inconvenient and obtrusive cables, create an instant wireless network on the go and extend the range of your current wireless network. AirPort Express can do all that in a tiny 6.7-oz package for only $129 and it will be available in July.
AirPort Express needs iTunes v4.6 which is expected to be available for download later this week.
Wow! We have been hauling around an original Apple graphite AirPort Base Station for years to get wireless internet in hotel rooms. Most hotels that we currently frequent have high speed internet connections so soon we will have a small 6.7-oz AirPort Express to replace our AirPort Base Station. Here is Apple's press release.
Saw something? Send a tip
The archive ran on reader tips. What did you see, where, and do you want the credit?