attn Mac OS X users, there's a new security exploit

[gold_bug]

There is a new security exploit on Mac OS X that involves the help:// and disk:// URI schemes. So far it's only annoying and not dangerous, but by using the exploit malicious scripts could in theory delete a user's entire home directory. I think only web browsers that use Apple's WebKit framework are vulnerable to this exploit, but I'm not sure about that. (Safari and OmniWeb both use WebKit).

To test if you are vulnerable to this exploit, go here:
http://bronosky.com/pub/AppleScript.htm
If you are vulnerable your Help Viewer application will launch, it will then run a script that opens the Terminal.

To patch this security exploit, you can use Don't Go There, GURLfriend 1.0 which can be downloaded here:
http://isophonic.net/

I assume Apple will offer a Security Update soon.

More information on the security exploit:

News.com: Mac OS X vulnerable to one-two combo attack
http://news.com.com/2100-7349_3-5215586.html?tag=nefd.top

Insecure News: Safari/help runscript: Proof Of Concept
http://www.insecure.ws/article.php?story=2004051612423136