MailBITS/14-Sep-98

Internet Explorer Cross-Frame Security Bug Patch -- Microsoft has announced a potential security problem affecting Internet Explorer that could enable a Web site operator to access the contents of your local disks. Dubbed the "cross-frame navigate" issue, the problem affects both Windows and Macintosh versions of Internet Explorer 3.x and 4.x. On the Mac, Internet Explorer 3.01, 4.0, and 4.01 are vulnerable although 3.0 is not; under Windows, any application (such as Eudora Pro) that can use Explorer's HTML engine could also be vulnerable. Microsoft has released a 2.3 MB updater for the Mac version of Internet Explorer 4.01 that fixes the problem; users of Explorer 3.01 and 4.0 must upgrade to version 4.01 and then apply the patch. Although little information is available, Microsoft claims to have no reports of anyone exploiting this loophole. [GD]

<http://www.microsoft.com/ie/security/?/ie/security/xframe.htm>
<http://www.microsoft.com/security/bulletins/ms98-013.htm>
<http://www.microsoft.com/msdownload/iebuild/xframe_mac/en/30926.htm>

Retrospect 4.1 Backs Up Via FTP -- Dantz Development today announced Retrospect 4.1, the latest version of their powerful backup software. The most important new feature, support for Internet backup sets, enables Retrospect to back up to remote FTP servers over the Internet; it's ideal for iMac users. Version 4.1 also includes a new disaster recovery CD that can boot modern Macs, support for additional devices (including DVD-RAM drives), improved speed and reliability, and expanded email reporting. Upgrades to 4.1, which Dantz expects to ship on 01-Oct-98, are free to customers who purchased Retrospect 4.0 after 01-Sep-98; otherwise the cost is $29.95, which includes free updates to Retrospect Clients. [ACE]

<http://www.dantz.com/dantz_products/prod_intros/retro4_1_intro.html>

iMac Update 1.0 Tweaks USB -- Apple has released the first software updates for the Bondi blue boxes. The first, a new CCL modem script, forces the iMac's internal modem to connect using 33.6 Kbps or slower speeds, possibly alleviating connection problems on noisy phone lines when the modem tries to connect at 56 Kbps. You need this script only if you have significant problems connecting to an ISP using the iMac's internal modem. The larger iMac Update 1.0 improves the compatibility of the iMac's USB drivers with third-party USB peripheral devices. Although Apple recommends that all iMac users install this update, only users with USB devices other than the iMac's keyboard and mouse should notice changes. The 2.1 MB iMac Update 1.0 replaces the entire Mac OS ROM file, and you can find it on Apple's well-done iMac Support site. [GD]

<http://www.apple.com/support/imac/>

Stairways Releases Anarchie Pro 3.0 -- Stairways Software has released Anarchie Pro 3.0, the latest version of the widely used file transfer program. Anarchie Pro 3.0 now sports HTTP download capabilities including a snappy Finder-like view of links in Web pages and the capability to download Web sites for offline browsing or authoring. Anarchie Pro 3.0 also enables users to resume FTP and HTTP file transfers (provided the remote server can resume transfers), synchronize remote FTP folders, and edit remote FTP files transparently with BBEdit. Much of Anarchie's interface has been revamped, and it offers several clever new touches, including a measure of recent throughput so you can determine if a transfer has stalled, and audio feedback when transfers start and end. Anarchie Pro 3.0 can override Internet Config so other applications can hand common file types to Anarchie for downloading and includes Apple Internet Access Detector (AIAD) actions for handing links to Anarchie Pro from any program that supports AIAD. By popular request, Anarchie Pro 3.0 now saves passwords with bookmarks and supports Apple's forthcoming Keychain, which will offer a secure method of storing sensitive information. Anarchie Pro 3.0 is $35 shareware ($20 if you upgrade from an earlier version), and requires System 7 or higher and MacTCP or Open Transport; it's an 800K download. [GD]

<http://www.stairways.com/anarchie/>
<http://applescript.apple.com/data_detectors/>

DoorStop 1.0 Released -- Open Door Networks has released DoorStop 1.0, a software-based firewall that promises to improve security on Macintosh-based Internet servers, particularly those providing AppleShare-over-IP services via Open Door's ShareWay IP. Operating only on the Macintosh on which it is installed, DoorStop enables you to block or grant access to specific TCP services - see "Open Door Slams Network Doors" in TidBITS-444 for more details. DoorStop requires a PowerPC-based Macintosh, Mac OS 8.1, and Open Transport 1.3 or later. Single copies of DoorStop cost $299 or $199 for education customers; other volume and site licenses are available. You can download a 680K evaluation version. [ACE]

<http://www2.opendoor.com/doorstop/>
<http://www.opendoor.com/shareway/>
<http://db.tidbits.com/getbits.acgi?tbart=05047>

Mailsmith 1.1 Released -- Bare Bones Software has released Mailsmith 1.1, a free update to the new email client. Mailsmith 1.1 sports significant performance improvements to the underlying database engine, more efficient use of space within the database, enhanced enclosure handling, user-defined labels, contextual menu support, a new Make Filter command for quick filter creation, optional nickname auto-completion, and mailbox maintenance tools. The updater for current Mailsmith users is a 2.8 MB download; there's also a 3.8 MB demo. [ACE]

<http://web.barebones.com/products/msmith/msmith.html>

Connectix Releases Speed Doubler 8.1.1 -- Connectix Corporation has released Speed Doubler 8.1.1, an update to the popular performance enhancing software. (See "Speed Doubler 8" in TidBITS-402.) Speed Doubler 8.1.1 works with the forthcoming Mac OS 8.5, improves compatibility with Mac OS Easy Open, StuffIt SpaceSaver, third-party file systems and storage devices, and utilities (like the shareware FinderPop) that allow items to be copied from places other than Finder windows. Speed Doubler's Keyboard Power feature - which enables users to navigate application menus via the keyboard - has also been completely written and is now PowerPC-native. Owners of any version of Speed Doubler 8 can download a free 750K updater from Connectix. [GD]

<http://www.connectix.com/html/speed_doubler_updates.html>
<http://db.tidbits.com/getbits.acgi?tbart=04210>