UPDATE: Security Vulnerability in Java Is Patched

A few weeks ago, we posted an article about a critical security vulnerability in Java on Mac OS X. Morgan Aldridge wrote “It’s a couple of vulnerabilities that can be taken advantage of to run commands outside of the browser as the user that launched the browser.” Read the original post by clicking here.

The vulnerability was discovered in August 2008 and was patched by Sun and other developers several months ago. When Apple didn’t move on the issue, a former Apple engineer named Landon Fuller released a proof of concept exploit that could, in his words, allow “malicious code to escape the Java sandbox and run arbitrary commands” that would “result in untrusted Java applets executing arbitrary code merely by visiting a web page hosting the applet.” Read about this by clicking here.

It’s taken a month since Fuller publicized this issue, but Apple has finally released updated versions of Java for both OS X 10.5 Leopard and OS X 10.4 Tiger.

To install this update, either run Software Update (under the Apple icon in the upper left corner of your Mac’s screen), or download the patch directly from Apple:

Click here to download the Java for Mac OS X 10.5.

Click here to download the Java for Mac OS X 10.4

Click the following links to read Apple’s related security documents for OS 10.5 Leopard and OS 10.4 Tiger

FYI, for long-term Safari web browsing security, we suggest that Safari users leave the ‘Open “safe” files after download’ option in Safari preferences permanently disabled. Other vulnerabilities could remain in Safari’s handling of “Safe” files if someone figures out how to to trick Safari’s understanding of “Safe” files. While that scenario is rather far-fetched, it’s better to be safe than sorry.

Similar Posts

  • Ed's Top 3 Favorite iPhone 3.0 Additions

    *1. Cut and Paste.* Finally. Cut and paste of text on the iPhone works well, and is implemented in a way that could also work well on any touch-screen based computer.

    *2. Notes Sync.* As many have said, it was silly/bizarre that this wasn’t supported on earlier versions of the iPhone OS. Notes is useful now!

    *3. Shake to Undo/Redo Typing.* If you are typing something and wish to erase it and start over, all you have to do is deliberately shake your iPhone and it will be erased. If you want it back, simply shake again. I admit, the tactile experience of erasing a mistake by shaking it away is great. I wonder if Apple borrowed this idea from Etch-a-Sketch?

    *Honorable mention:* swearing is now allowed on the new iPhone. Rod Blagojevich must be very happy.

  • Mac Treat #90: Favorite iPhone Tips + Websites

    The iPhone and iPod touch are amazing devices with many useful but hidden or undocumented features. Discovering these hidden features and having “ah ha” moments is part of the fun of owning an iPod touch or iPhone. It’s equally fun to share your iPhone tips and tricks with other iPhone owners, because you get to share their “ah ha” moments.

    Most of the “hidden” iPhone features I know came from the following websites. They are worth checking out — you’ll almost certainly learn something new.

    Here are some of my favorite websites for getting more from these devices, as well as uncovering some of their hidden features.

    * “iPhone Alley has some great, easy to read tips and tricks.”:http://www.iphonealley.com/tips

    * “iSmashphone.com also has some great iPhone / iPod touch tricks”:http://www.ismashphone.com/2008/08/iphone-tricks.html

    * “Here’s a recent iSmashphone article about How To Use The Best 40 Features of iPhone 3.0”:http://www.ismashphone.com/2009/06/how_to_use_best_40_features_of_iphone_3.html

    * “From iPhone J.D., some favorite iPhone shortcuts”:http://www.iphonejd.com/iphone_jd/2008/11/my-favorite-sho.html

    * “Macrumors has a list of more than 100 hidden features in the iPhone 3.0 upgrade.”:http://forums.macrumors.com/showthread.php?t=715629

    * “Another list of hidden iPhone 3.0 tips.”:http://pcworld.about.com/od/phones/iPhone-3-0-Update-10-Hidden-F.htm

    * “Tuaw.com often has useful iPod touch / iPhone information.”:http://www.tuaw.com/tag/iphone/

    * “Of course, there is always Apple’s iPhone page, which has everything from basic to advanced tips. “:http://www.apple.com/iphone/how-to/#basics.introduction

  • There seems to be a bunch of rain in the forecast for the next several days. The garden loves it (and so do the weeds) but motorcyclists don’t. I may have to just buck-up and do a rain-or-shine ride over to Laconia for the last day of Bike Week, but this could also be a good opportunity to do some chores before Grace gets back on Sunday. I think I’ll have to see what new cool iPhone 3.0 apps are released, too!

    Thank you so much for reading this issue of Kibbles & Bytes.

    Your Kibbles & Bytes Team
    _Don, Kali & Ed_

  • FEATURED SPECIAL | 06/19/09 – 06/26/09

    This week’s Featured Special is a little esoteric for many users, but we have an amazing price and it’s worth sharing. Right now we have some Apple refurbished Quad-Core 2.8GHz Xserves loaded with 6GB RAM and an 80GB drive module, for only $2299.99. Since these are Apple refurbished, they have a full one-year factory warranty and are eligible for “AppleCare.”:http://www.smalldog.com/product/73809

    They include the innovative and easy to use Mac OS 10.5 Leopard Server (unlimited clients).

    For a school, small business, or home business, the Xserve offers amazing technology at an excellent price! Also, our team of technicians and Apple consultants can help you set it up.

  • SOAPBOX | The Designated Hitter Rule is a Travesty

    *Start Soapbox*

    The new MLB iPhone application will now stream live game video in addition to the audio feeds. The first game to be boardcast is the Cubs versus White Sox. We are in the midst of inter-league play and once again, that unfortunate mistake that will always make the American League the junior league becomes more apparent–the designated hitter rule.

    Adopted in 1973, the rule has artificially inflated the hitting percentage of the American League and has allowed older players who can no longer play a defensive position to extend their careers unnaturally. This isn’t football where you have an offense and defense and different players for each–this is baseball where nine players play both offense and defense!

    Baseball is the game of inches; the game of details. The strategy for managers of when to lift a pitcher, who to pinch hit, where that player might play are all integral parts of the game of baseball. The double switch is something American League teams just don’t know, yet it is an important part of baseball.

    The national league has produced some great hitting pitchers. One of the best plays for my Chicago Cubs. Carlos Zambrano is one of the best hitters on the team and is their pitching ace, too. (He is frequently used as a pinch hitter!)

    Hitting pitchers are rare, though and during inter-league play the American league home team automatically receives a significant unnatural advantage by shielding their pitchers and having that one-dimensional hitter on their roster.

    I haven’t liked the American League since before the DH was instituted, but that rule is truly a travesty and should be repealed!

    *End Soapbox*

  • iPhone OS 3.0 Full Review

    Apple released the much-anticipated iPhone OS 3.0 software on Wednesday, and since then, we have been busy over here testing what’s new. With over 100 new features, v3.0 is no minor upgrade for iPhone and iPod touch users.

    However, after all the buzz, the transition to v3.0 seemed a little anti-climactic. Only one new app icon appeared on my phone after the installation. Was that it? Not even close–while the change in appearance is slight, there’s much more behind the scenes.

    The new features highlighted on Apple’s website have gotten a lot of hype, but the lesser-known features are worth a mention as well (and have been a lot of fun to discover!). Here, I’ll explore the real-world application of the main features and some of my favorite ‘hidden’ ones in the iPhone OS 3.0 upgrade.

    *MAIN FEATURES*
    *Cut, Copy & Paste*
    To quote Ed, “Finally.” Even though other smartphones have had this for a while, we’re still excited. Call it the “#1 feature the iPhone should have had in the first place,” but the __way__ it works is the best part: it’s seamlessly integrated into all applications.

    Simply touch the screen where you want to copy, and a dialog box will pop up. Select the word or block of text that you would like to copy, and select “Copy.” When you have the spot open where you would like to paste the selection, touch again and the “Paste” command will pop up.

    __Note:__ Your copy/paste dialog box may vary between applications, but the principle is the same. In Safari, touching the screen will immediately bring up the Copy dialog box. In Mail, you will be prompted to either Select or Select All and then Copy. The only place where I ran into a problem was in MMS, where my only option was to select the entire conversation bubble, rather than just a section of it. In that case, I copied the entire block of text into a new note, and then selected the snippet I wanted from there.

    *Landscape Orientation*
    Not much to elaborate on here, since landscape mode is pretty straightforward. As promised, every application I used supported landscape mode except for one–apparently, it is not supported in Search! Maybe that will change with the next update?

    *Spotlight Search*
    Aside from the aforementioned incompatibility with landscape mode, Spotlight on the iPhone is pretty great. With a simple swipe of your finger to the left (the same motion you make when you flip pages back to the Home screen), the Search field pops up. It was so intuitive, I discovered it accidentally.

    Spotlight searches all of your contacts, email, music, calendars and applications, and sorts the results by the best match. One click on a result takes you to that selection–if it’s an app, it opens; if it’s a song, it plays, and so on.

    *Voice Memos*
    This application now resides on my Home screen, on which I gladly made room after I discovered that it will work with my Rap Cap to record–you guessed it–voice memos. Not into talking to yourself? Use it to record anything else you please (the only limitation is the capacity on your device) and you can then share the file via email. The result is a standard .m4a file format, which can be used with iTunes, QuickTime or dozens of other media software.

    The interface is slick, and Apple keeps it simple with as few buttons as possible and the glossy image of an old school microphone (which I keep imagining Frank Sinatra or Edward R. Murrow either crooning or broadcasting into, respectively) and “audio VU meter,”:http://en.wikipedia.org/wiki/VU_meter complete with a virtual needle.

    *Find My iPhone*
    A plus of a MobileMe account now (especially for those forgetful types) is Find My iPhone, where users can now locate a lost or stolen phone via GPS technology. All you need to do is a quick setup.

    First, to activate it on your iPhone, go into *Settings > Mail, Contacts, Calendars* and select your MobileMe account. Flip the Find My iPhone switch to On. Then, log in to your “MobileMe account,”:http://www.me.com click the Accounts icon, and select Find My iPhone on the lefthand side. The map will zero in on the phone’s location.

    As Don mentioned, it does not pinpoint the __exact__ location, but does give a pretty accurate radius to either jog your memory if you’ve misplaced it, or a tip to tell the cops when you report it stolen! If it’s the latter, you can then remotely ‘wipe’ the data to keep your info safe. If it’s the former, you may want to just send an audible alert to the phone to help you find it.

    Note: When I tested this, it showed the location data within the last 24 hours. I was able to refresh it by selecting Update Location, and it accurately updated the map to display my phone’s current location.

    *Improved Calendar*
    There’s support now for Microsoft Exchange ActiveSync as well as search capabilities via Spotlight. Shared calendars are supported through “CalDAV,”:http://en.wikipedia.org/wiki/CalDAV but currently, there is no way to sync them. I was a little disappointed that there wasn’t more to the iCal improvements, but it’s a start.

    *Parental Controls*
    I don’t personally need this (at least not yet), but it’s great that Apple is giving users the choice to customize system access and censor the content on the internet if they wish.

    To enable restrictions, go to *Settings > General > Restrictions* on your iPhone. Assign a password, and then toggle an On/Off switch for access to any/all of the following categories: Safari, YouTube, iTunes, Installing Apps, Camera and Location.

    Among the allowed content, you may then select the level of access in the iTunes Store, which now limits browsing to only certain ratings of shows/movies (G, PG, etc.), music, podcasts and apps that are age appropriate (7, 9+, etc.). (Apple now requires developers to assign an age rating to each app.)

    *HIDDEN GEMS*
    As Ed noted, there are many websites out there that have posted some of the ‘hidden’ features if the iPhone OS 3.0 software. Here are some of my favorites:

    *Added Keyboard Characters*
    The keyboard now has certain keys that display extra options when you hold them down. A period reveals an ellipsis symbol, the dash reveals an emdash option and the apostrophes can reveal “smart” quotes. Cool!

    *iPod Controls*
    If you have your iPhone set to auto lock at any point when listening to music, you will eventually need to “slide to unlock” to fast forward a song that you’d like to skip over. Now, if you press the Home button twice, the iPod controls will pop up without unlocking your device. __Thanks, Ed!__

    *Force Quit*
    To quit an unresponsive app in v3.0, hold the Sleep/Wake button at the top of the device until the red slider appears that says “slide to power off.” Then, hold down the Home button to quit the unresponsive application. Hopefully, no one has to use this much.

    *Unlimited App Pages*
    Now, you are no longer limited to 8 pages (or was it 9?). No matter–now you can fill your phone with as many apps as your device has room for! The only caveat is that if you go beyond the 11 pages (which translates to 176 icons), they are not visible and can only be accessed through Spotlight.

    *Camera Options*
    The Camera app now gives you a preview of the last photo you took in the lower lefthand corner, where the symbol for your Camera Roll used to be. You can also now email more than one photo at a time!

    *COMING SOON*
    There are also some core features are aren’t available yet, because they require AT&T’s full support. Among them:

    *MMS (Multimedia Messaging Service)*
    MMS allows users to view photos, hear audio, see contacts and locations all in one application. Recently, I received a video message from a friend that I couldn’t view in my SMS app. “No problem,” I thought–the message included an access code and password for AT&T’s website so I could login and see it there.

    However, both codes were a long, random character combination and in the absence of a copy and paste feature, I couldn’t easily access it without a pen and paper (how archaic!). Unfortunately, I never manually copied the codes for the login, and AT&T deleted the message seven days later before I could view it. D’oh! Hopefully, we will see support for this later this summer.

    *Tethering*
    Have you ever needed internet access desperately, and no Wi-Fi was available? The great thing about tethering is that you will be able to connect your iPhone to your computer and share its internet connection (via cell tower) through USB or Bluetooth. This will work on both Macs and PCs and uses the 3G network.

    This is not yet supported by AT&T, though there __is__ a workaround for those who can’t wait. “Find out here if you’re curious.”:http://reviews.cnet.com/8301-19512_7-10265889-233.html

    *Turn-By-Turn GPS*
    Finally, we’ll be able to use the iPhone as a real GPS. TomTom will be releasing an app in the App Store that will dictate turn-by-turn directions to you in the car as well as a corresponding car accessory that will mount your device to the windshield for hands-free access.

    I can’t possibly list everything, but in short, this seamless, yet feature-rich upgrade is an absolute necessity for any existing or new iPhone or iPod touch user. Apple is firmly (back) at the top of the smartphone competition!