Shortly after reports of the first virus for Mac OS X, a new security flaw has surfaced. The culprit is the option "Open "safe" files after downloading" in Apple"s Safari web browser. This feature is activated by default. Its function is to automatically display images and movies after they are transmitted to the user"s computer, using the application assigned to that particular document format. Safari will also unpack ZIP archives and display the documents within if they are considered "safe".
If active content such as an application or shell script is found within the archive, a prompt requests user confirmation. So far, so good. Problems ensue if a shell script is stored into a ZIP archive without the so-called shebang line. If this line is omitted, Safari no longer recognizes the content as potentially dangerous and executes shell commands without a confirmation prompt. This behavior has been discovered by Michael Lehn, who has documented it on a web site.