Security Update 2012-004 and Mail Plugins
Why does Security Update 2012-004 for 10.6 kick out Mail 4.6 Plugins like GrowlMail 1.2.5?
MacBook Pro, Mac OS X (10.6)
Why does Security Update 2012-004 for 10.6 kick out Mail 4.6 Plugins like GrowlMail 1.2.5?
MacBook Pro, Mac OS X (10.6)
from http://support.apple.com/kb/HT5501
"Impact: Viewing an e-mail message may lead to execution of web plugins
Description: An input validation error existed in Mail's handling of embedded web plugins. This issue was addressed by disabling third-party plug-ins in Mail."
I don't pretend to understand the technical nature of the vulnerability, but simply read those Mail plug-ins could be risky.
Isn't it great that Snow Leopard got a security update!!! A big THANK YOU Apple. Keep it going.
A big THANK YOU to lesse for the tip ... I was able to use it to get MailFollowUp working again (using jazzmosax's tip to change the names).
It's a plugin I rely on, that is no longer updated for Snow Leopard, so thank you very much to the community for helping fix stuff when Apple randomly breaks things...
(P.S.: Isn't disabling all add-ons a pretty lazy fix by Apple if their program doesn't handle them securely enough?)
Thanks to all.
The Terminal text worked perfectly: I used it to fix Letterbox and MailFollowUp.
I found it also works for ASPBundle, a useful plugin which spots if I've forgotten to attach an attachment...
(Mail Act-On and Dockstar both provide updates to make them compatible with this security update.).
I agree with AlwaysWrite that very sloppy on the part of Apple to leave users to have to work through all of this - and without any warning that this will be the effect).
Yes, that worked for the GrowlMail plugin for Mail 5.3 under OS X 10.7.5. Thank you so much. Can't believe that the Growl Developers are not working on this, and that the GrowlMail developers have not update this. Oh well.
Thank you so much!
Martin
Dear all
How I can go back from this security update ?
regards
Hello jcrduboudin
Not sure how you would roll back. Maybe do a complete restore from a backup? I personally wouldn't go back, but try to apply one of the fixes as listed in this thread. It sure worked for me and I get my growlmail notifications again. Worth a try.
Martin
jcrduboudin wrote:
Dear all
How I can go back from this security update ?
regards
I agree with Martin, why would you want to? There's better things in the Update that make up for the lack of Growl Mail notifications...and, if you read the posts of others (and mine, scroll up a bit), you should be able to get those working again as well.
--Forrest
I've got several Mail plugins that did not work after running the "SecUpd2012-004" Security Update, which updated Mail.app from v4.5 to v4.6, and I'm sure there are others of you out there who ran into the same consequential problem.
Here is the downloadable fix I found, developed by Code2K:Labs:
From the Code2K:Labs site: http://code2k.net/products/mailpluginfix/
From MacUpdate: http://www.macupdate.com/app/mac/37804/mailpluginfix
KK
I've got several Mail plugins that did not work after running the "SecUpd2012-004" Security Update, which updated Mail.app from v4.5 to v4.6, and I'm sure there are others of you out there who ran into the same consequential problem.
Here is the downloadable fix I found, developed by Code2K:Labs:
From the Code2K:Labs site: http://code2k.net/products/mailpluginfix/
From MacUpdate: http://www.macupdate.com/app/mac/37804/mailpluginfix
KK
Thanks for the link. Tried this after looking for a solution, and it worked perfectly! Wish I had found this several days ago. This was totally automatic no manual entrieswith Text Wrangler.
I tried several approaches. None worked until I restarted my computer.
My final attempt was using JML54's solution on Sept. 22, 2012. Then, before opening Mail, I restarted the computer. When my Mac restarted, Letterbox was running again just like always.
Which plist do you refer to, the com.growl.GrowlMail.plist in User/Library/Preferences or the
info.plist in the GrowlMail plugin bundle?
My GrowlMail bundles shows all these so not quite sure what to do with the two UUID's mentioned.
<string>EF59EC5E-EFCD-4EA7-B617-6C5708397D24</string>
<string>6E7970A3-E5F1-4C41-A904-B18D3D8FAA7D</string>
<string>2DE49D65-B49E-4303-A280-8448872EFE87</string>
<string>1146A009-E373-4DB6-AB4D-47E59A7E50FD</string>
<string>9049EF7D-5873-4F54-A447-51D722009310</string>
<string>1C58722D-AFBD-464E-81BB-0E05C108BE06</string>
<string>BDD81F4D-6881-4A8D-94A7-E67410089EEB</string>
<string>857A142A-AB81-4D99-BECC-D1B55A86D94E</string>
<string>B3F3FC72-315D-4323-BE85-7AB76090224D</string>
<string>225E0A48-2CDB-44A6-8D99-A9BB8AF6BA04</string>
<string>99BB3782-6C16-4C6F-B910-25ED1C1CB38B</string>
<string>2610F061-32C6-4C6B-B90A-7A3102F9B9C8</string>
<string>2F0CF6F9-35BA-4812-9CB2-155C0FDB9B0F</string>
<string>0CB5F2A0-A173-4809-86E3-9317261F1745</string>
<string>B842F7D0-4D81-4DDF-A672-129CA5B32D57</string>
<string>E71BD599-351A-42C5-9B63-EA5C47F7CE8E</string>
<string>4C286C70-7F18-4839-B903-6F2D58FA4C71</string>
<string>EF59EC5E-EFCD-4EA7-B617-6C5708397D24</string>
I was only worried about Letterbox. Not sure if this will help with Growl. The files you want to edit will be in the disabled plugins folder.
Here's the previous post from JML54 on Sept 22, 2012:
In Snow Leopard, I was able to re-enable these plugins without Terminal, using TextWrangler to edit the plist files:
ASPBundle.mailbundle
Letterbox.mailbundle
MailFollowUp.mailbundle
MailRecent.mailbundle
Open the folder with the disabled plugins. Then, right-click on the plugin and show the package contents. Find the plist file. Using TextWrangler, edit the plist file by adding these lines to the UUID listing:
<string>064442B6-53C0-4A97-B71B-2F111AE4195B</string>
<string>588FF7D1-4310-4175-9980-145B7E975C02</string>
Save the file. Put the disabled plugins back into the Bundles folder and open Mail.
I was only concerned with Letterbox. After adding the above UUID lines to the Letterbox.mailbundle file, I closed it, and restarted my computer before launching Mail again. Only then did the changes I made to the mailbundle file remain. Every other time I made changes and then launch Mail, the edits would be removed and the Letterbox.mailbundle file would be moved to the disabled plugins folder. So, try that. Edit the file, then immediately restart your computer before running Mail.
Hello, Apparently Objective Decision released a new version after this apple Javav upgrade, but after warned them about this trouble, they did not changed anything so the only working solution is to mannually deplace the new ? version of ODMail.bundle inside the ressource folder of the contactizer app folder [access by right button open this paquage, or something like that.]
So open ODMailbundle.bundle you extract from the contactizer app folde, and modify it as indicated here
adding the 2 strings
<string>064442B6-53C0-4A97-B71B-2F111AE4195B</string>
<string>588FF7D1-4310-4175-9980-145B7E975C02</string>
Save the file. put the bundle in bundle folder of mail.app in libraries/mail/bundles and open Mail. It seems to be not rejected.
If you open contactizer before doing this you will have an error message telling you contactizer will not be able to connect to mail.app. dont worry, the software try to find the original dundle inside the ressources folder and try to download a new version . Close contactizer, If you didn't already put the bundle in bundle folder of mail.app in libraries/mail/bundles.
lauch contactizer, everything is all right.
I have added the UUIDS (all of them) by the terminal and confirmed their existance by opening the plist file in Xcode.
Unfortunately, it is still not working but I wonder if I have the correct UUIDs as this seems to be the current fix.
Setup:
Mail 5.3 (1283)
Growl 2.0 purchased via App Store and updated to the 9/19/2012 update.
Current UUIDS:
758F235A-2FD0-4660-9B52-102CD0EA897F
3335F782-01E2-4DF1-9E61-F81314124212
064442B6-53C0-4A97-B71B-2F111AE4195B
588FF7D1-4310-4175-9980-145B7E975C02
The last two being added on a lark to see if it would work.
Any help would be greatly appreciated.
EDIT:
Solution found. UUIDs required for my setup 758Fxxx abd 3335Fxxx. A typo in the defaults command added to SupportedPluginCompatibilityUUIDS instead of SupportedPluginCompatibilityUUIDs. When viewed in Xcode, I didn't register the two different entries until after posting.
Works like a charm now.
Hi Veit,
I am having problems with Contactizer and you are the only one on the web mentioning the ODMailBundle issue. In the meantime, Contactizer is not syncing and I am about ready to throw it out the window. Can you please be specific on how you solved the bundle problem? Thanks!
Security Update 2012-004 and Mail Plugins