"Apple Computer got hit by a double whammy this week when a security researcher publicized a pair of flaws in Mac OS X that when used together could let attackers place a malicious program on a Mac and then run the file. The flaws could be used to create a virus that spreads through a Web link sent via e-mail messages. An attacker would have to also create a Web site with special programming," reports CNet.
"Security information service Secunia rated the issue 'extremely critical,' on Tuesday, because online discussions have pointed out many different ways to exploit the flaws. Secunia recommended that Mac users avoid visiting untrusted Web sites and said Mac administrators and others avoid surfing the Internet while signed on to their networks as privileged users."
Comment: The Secunia advisory is here.
Update, Monday: Infoworld reports: "Apple issued a patch for the 'help' flaw on Friday, but the fix leaves the 'disk' problem unpatched, experts said. 'Mac users are as vulnerable now, as before the patch was released,' Niels Henrik Rasmussen, chief executive of security firm Secunia told us. ... A temporary fix is to modify the Mac's Internet preferences, turning off the option to open 'safe' files after downloading and adding a helper application for the 'disk' and 'disks' protocols, the company said in its advisory."
