Heise Online has a report outlining how the shell script execution flaw in Safari also applies to Mail.app.

Both apps will execute scripts without asking permission in certain circumstances.

As the report explains:

It suffices to disguise a script with the ending “jpg” and assign the Terminal application for opening it. If this script is then sent in the AppleDouble format as an attachment, the information is passed along so that the recipient’s system also opens it with the Terminal.

Apple Mail displays the attachment with a JPG file symbol, but when users click on it, the script executes within Terminal without further prompting. This has been tested on Apple Mail 2 and Mac OS X 10.4. Older versions display a warning.

You can experience the flaw for yourself. The Heise Online site provides an example email which demonstrates the problem. It arrives with what looks like a JPG attachment. Clicking on the JPG file executes a harmless script in Terminal containing the command /bin/ls -al.

It’s in German, but enter your email address in the text box on this page and click the button marked “Anfordern”. Then click on the link in the confirmation email and an example is on its way to you.

An immediate fix is to move Terminal into a different folder. The general fix, of course, is never to open attachments in emails that you are unsure about.

Thunderbird, the article points out, doesn’t fall for this trick.security flaw, scripts, terminal, mail.app, apple mail, attachments, AppleDouble, bugs

Rob Griffiths of macOSXHints fame has posted a tip for reducing the delay between selecting text and being able to drag it in Cocoa-based applications like Apple Mail. Normally, you need to select the text, click and wait for a second, then drag it.

It involves a simple Terminal hack. Open Terminal and type (exactly):

This will reduce the delay from the one second default to a tenth of a second in all your Cocoa-based apps (‘-g’ stands for ‘global’).

You will, of course, need to restart them for the change to take effect.

I get caught out by this sometimes in Mail.app, and end up having to select the text I want twice. Not any more!