The first Mac OS X 10.4 hole has been discovered. Unfortunately, it's a rather ugly one.
A developer has demonstrated a Dashboard exploit in Mac OS X 10.4 Tiger that a malicious Web site owner could use to install widgets you might not want on your Mac.
Writing under the name of Stephan.com, the developer said that a combination of Apple's lack of documentation for removing widgets, Safari's download controls, and a widget feature all make it possible for the bad guys to use Dashboard to take you to any Web site of their choosing, hijacking Dashboard for their nefarious purposes.
At issue is a feature in Safari called "Open safe files" that is turned on by default. This feature allows your Mac to automatically open image files, PDFs, movies, disk images and other files considered safe when downloaded. Unfortunately, this also includes widget files downloaded, which are installed when opened.
