August 3rd, 2009
Apple: GarageBand leaks user data to advertisers
Apple today warned that its GarageBand software is leaking users’ Web activity to third parties and advertisers.
The company shipped GarageBand 5.1 to plug the hole and advise users to tweak their Safari browser preferences to avoid data leakage. Here’s the relevant information from Apple’s advisory:
- CVE-2009-2198: When GarageBand is opened, Safari’s preferences are changed to always accept cookies. The default preference is to accept cookies only for the sites being visited. The altered setting may allow third parties and advertisers to track a user’s web activity.
The update addresses the issue by not changing the preference setting. Users who have run previous versions of GarageBand should confirm that their Safari preferences are set as desired, Apple said.
GarageBand 5.1 is available via the Apple Software Update application or Apple’s GarageBand download site.
Ryan Naraine is a journalist and security evangelist at Kaspersky Lab. He manages Threatpost.com, a security news portal. Here is Ryan's full profile and disclosure of his industry affiliations.
For daily updates on Ryan's activities, follow him on Twitter.
Subscribe to Zero Day via Email alerts or RSS.
