Intego Issues Leopard Vulnerability Warning--Mail Attachment Quarantine Bug (Low Risk)

Intego, the maker of anti-malware software, sent us a note describing a vulnerability in Mac OS X 10.5 Leopard's "quarantine" system involving Mail attachments and providing a proof of concept. Intego rates the bug they term "OSX.Exploit.MetaData.B" as a low risk.

If you are using Leopard and download an application as a disk image via Safari, Mail or iChat, when you manually add it to your Applications folder or launch it the first time a dialog box pops up stating that the application has been downloaded from the Internet and asks if you really want to open/launch it. This system is a mild protective measure against malware.

The problem is that an attachment to Mail pretending to be an image, but is really a script with resource fork, can be opened/launched the first time without going through the quarantine system. Even worse, if the "same" attachment is received twice or more times, it never goes through the quarantine system. In either case, a malicious application file could be downloaded, launched and run inadvertently.

Intego's advice is the usual. Do not try to open attachments from people you do not know or that you do not expect even from people you know. This vulnerability was first posted by Heise Security. [Bill Fox]