Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Security Update 2012-004 and Mail Plugins

Why does Security Update 2012-004 for 10.6 kick out Mail 4.6 Plugins like GrowlMail 1.2.5?

MacBook Pro, Mac OS X (10.6)

Posted on Sep 19, 2012 3:12 PM

Reply
Question marked as Best reply

Posted on Sep 19, 2012 4:21 PM

from http://support.apple.com/kb/HT5501

"Impact: Viewing an e-mail message may lead to execution of web plugins

Description: An input validation error existed in Mail's handling of embedded web plugins. This issue was addressed by disabling third-party plug-ins in Mail."


I don't pretend to understand the technical nature of the vulnerability, but simply read those Mail plug-ins could be risky.


Isn't it great that Snow Leopard got a security update!!! A big THANK YOU Apple. Keep it going.

72 replies

Sep 28, 2012 8:38 AM in response to lesse

A big THANK YOU to lesse for the tip ... I was able to use it to get MailFollowUp working again (using jazzmosax's tip to change the names).


It's a plugin I rely on, that is no longer updated for Snow Leopard, so thank you very much to the community for helping fix stuff when Apple randomly breaks things...


(P.S.: Isn't disabling all add-ons a pretty lazy fix by Apple if their program doesn't handle them securely enough?)

Sep 29, 2012 1:48 AM in response to Claas Hanken

Thanks to all.


The Terminal text worked perfectly: I used it to fix Letterbox and MailFollowUp.


I found it also works for ASPBundle, a useful plugin which spots if I've forgotten to attach an attachment...


(Mail Act-On and Dockstar both provide updates to make them compatible with this security update.).


I agree with AlwaysWrite that very sloppy on the part of Apple to leave users to have to work through all of this - and without any warning that this will be the effect).

Oct 5, 2012 4:50 PM in response to Thierry de Villeneuve

I've got several Mail plugins that did not work after running the "SecUpd2012-004" Security Update, which updated Mail.app from v4.5 to v4.6, and I'm sure there are others of you out there who ran into the same consequential problem.


Here is the downloadable fix I found, developed by Code2K:Labs:


From the Code2K:Labs site: http://code2k.net/products/mailpluginfix/


From MacUpdate: http://www.macupdate.com/app/mac/37804/mailpluginfix


KK

Oct 5, 2012 4:53 PM in response to Claas Hanken

I've got several Mail plugins that did not work after running the "SecUpd2012-004" Security Update, which updated Mail.app from v4.5 to v4.6, and I'm sure there are others of you out there who ran into the same consequential problem.


Here is the downloadable fix I found, developed by Code2K:Labs:


From the Code2K:Labs site: http://code2k.net/products/mailpluginfix/


From MacUpdate: http://www.macupdate.com/app/mac/37804/mailpluginfix


KK

Oct 15, 2012 1:52 AM in response to mweger

Which plist do you refer to, the com.growl.GrowlMail.plist in User/Library/Preferences or the

info.plist in the GrowlMail plugin bundle?

My GrowlMail bundles shows all these so not quite sure what to do with the two UUID's mentioned.


<string>EF59EC5E-EFCD-4EA7-B617-6C5708397D24</string>

<string>6E7970A3-E5F1-4C41-A904-B18D3D8FAA7D</string>

<string>2DE49D65-B49E-4303-A280-8448872EFE87</string>

<string>1146A009-E373-4DB6-AB4D-47E59A7E50FD</string>

<string>9049EF7D-5873-4F54-A447-51D722009310</string>

<string>1C58722D-AFBD-464E-81BB-0E05C108BE06</string>

<string>BDD81F4D-6881-4A8D-94A7-E67410089EEB</string>

<string>857A142A-AB81-4D99-BECC-D1B55A86D94E</string>

<string>B3F3FC72-315D-4323-BE85-7AB76090224D</string>

<string>225E0A48-2CDB-44A6-8D99-A9BB8AF6BA04</string>

<string>99BB3782-6C16-4C6F-B910-25ED1C1CB38B</string>

<string>2610F061-32C6-4C6B-B90A-7A3102F9B9C8</string>

<string>2F0CF6F9-35BA-4812-9CB2-155C0FDB9B0F</string>

<string>0CB5F2A0-A173-4809-86E3-9317261F1745</string>

<string>B842F7D0-4D81-4DDF-A672-129CA5B32D57</string>

<string>E71BD599-351A-42C5-9B63-EA5C47F7CE8E</string>

<string>4C286C70-7F18-4839-B903-6F2D58FA4C71</string>

<string>EF59EC5E-EFCD-4EA7-B617-6C5708397D24</string>

Oct 15, 2012 8:14 AM in response to treeplant

I was only worried about Letterbox. Not sure if this will help with Growl. The files you want to edit will be in the disabled plugins folder.


Here's the previous post from JML54 on Sept 22, 2012:


In Snow Leopard, I was able to re-enable these plugins without Terminal, using TextWrangler to edit the plist files:


ASPBundle.mailbundle

Letterbox.mailbundle

MailFollowUp.mailbundle

MailRecent.mailbundle


Open the folder with the disabled plugins. Then, right-click on the plugin and show the package contents. Find the plist file. Using TextWrangler, edit the plist file by adding these lines to the UUID listing:


<string>064442B6-53C0-4A97-B71B-2F111AE4195B</string>

<string>588FF7D1-4310-4175-9980-145B7E975C02</string>


Save the file. Put the disabled plugins back into the Bundles folder and open Mail.



I was only concerned with Letterbox. After adding the above UUID lines to the Letterbox.mailbundle file, I closed it, and restarted my computer before launching Mail again. Only then did the changes I made to the mailbundle file remain. Every other time I made changes and then launch Mail, the edits would be removed and the Letterbox.mailbundle file would be moved to the disabled plugins folder. So, try that. Edit the file, then immediately restart your computer before running Mail.


Oct 17, 2012 7:57 AM in response to Claas Hanken

Hello, Apparently Objective Decision released a new version after this apple Javav upgrade, but after warned them about this trouble, they did not changed anything so the only working solution is to mannually deplace the new ? version of ODMail.bundle inside the ressource folder of the contactizer app folder [access by right button open this paquage, or something like that.]

So open ODMailbundle.bundle you extract from the contactizer app folde, and modify it as indicated here

adding the 2 strings

<string>064442B6-53C0-4A97-B71B-2F111AE4195B</string>

<string>588FF7D1-4310-4175-9980-145B7E975C02</string>


Save the file. put the bundle in bundle folder of mail.app in libraries/mail/bundles and open Mail. It seems to be not rejected.

If you open contactizer before doing this you will have an error message telling you contactizer will not be able to connect to mail.app. dont worry, the software try to find the original dundle inside the ressources folder and try to download a new version . Close contactizer, If you didn't already put the bundle in bundle folder of mail.app in libraries/mail/bundles.

lauch contactizer, everything is all right.

Oct 17, 2012 11:49 AM in response to lesse

I have added the UUIDS (all of them) by the terminal and confirmed their existance by opening the plist file in Xcode.


Unfortunately, it is still not working but I wonder if I have the correct UUIDs as this seems to be the current fix.


Setup:

Mail 5.3 (1283)

Growl 2.0 purchased via App Store and updated to the 9/19/2012 update.


Current UUIDS:

758F235A-2FD0-4660-9B52-102CD0EA897F

3335F782-01E2-4DF1-9E61-F81314124212

064442B6-53C0-4A97-B71B-2F111AE4195B

588FF7D1-4310-4175-9980-145B7E975C02


The last two being added on a lark to see if it would work.


Any help would be greatly appreciated.


EDIT:


Solution found. UUIDs required for my setup 758Fxxx abd 3335Fxxx. A typo in the defaults command added to SupportedPluginCompatibilityUUIDS instead of SupportedPluginCompatibilityUUIDs. When viewed in Xcode, I didn't register the two different entries until after posting.


Works like a charm now.

Oct 18, 2012 8:03 AM in response to veit

Hi Veit,

I am having problems with Contactizer and you are the only one on the web mentioning the ODMailBundle issue. In the meantime, Contactizer is not syncing and I am about ready to throw it out the window. Can you please be specific on how you solved the bundle problem? Thanks!

Security Update 2012-004 and Mail Plugins

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.