Neowin.net

Hackers could steal credit cards from ‘e-wallet’ technology

Microsoft Corp. acknowledged that its “Passport” technology for safeguarding Internet purchases has a serious design flaw that could have allowed hackers to steal credit card numbers and personal information.

2 million customers use the “e-wallet” feature of Passport that was vulnerable, but there was no evidence of any theft. It temporarily shut down access by all consumers to their virtual wallets starting Wednesday for repairs to the network and testing. That move inconvenienced buyers at roughly 70 e-commerce Web sites that support Microsoft’s wallet technology, called “Express Purchase.”
Overall, up to 200 million people have signed up for Passport accounts, which are nearly impossible to avoid under Microsoft’s new Windows XP operating system. Passport promises consumers a single, convenient method for identifying themselves across different Web sites.
“We do not believe customer data was compromised in any way,” Microsoft spokesman Adam Sohn said Friday. “We know we’ve got to build and earn trust for (Passport) to be successful. We’re taking the right steps to do that.”
Users of Windows XP software were never vulnerable because of additional security measures built in, Sohn said.

News source: msnbc

Found this in the MacNN forum and on Slashdot, explains the problem quite nicely!!!

The original installer script has the lines

# if iTunes application currently exists, delete it
if [ -e $2Applications/iTunes.app ] ; then
rm -rf $2Applications/iTunes.app 2> /dev/null
fi

while the replacement (2.0.1) has

# if iTunes application currently exists, delete it
if [ -e "$2Applications/iTunes.app" ] ; then
rm -rf "$2Applications/iTunes.app" 2> /dev/null
fi

Thanks to a tip in an email about the cause of the problem (spaces in volume names), I went digging into the package installer and think I found the source of the problem. The following code is in a file called 'preflight' inside the iTunes.pkg installer (in Contents/Resources):

# if iTunes application currently exists, delete it
if [ -e $2Applications/iTunes.app ] ; then
rm -rf $2Applications/iTunes.app 2< /dev/null
fi

So what's the problem? If your volumes have spaces and are named similarly (let's say "Disk", "Disk 1", and "Disk 2"), then this bug could bite you. The '$2' variable that's passed in contains the path to your selected iTunes installation destination. In our example, let's assume it was headed for "Disk 1". So '$2' should contain /Volumes/Disk 1 (notice the backslash for the space). However, if it instead contained /Volumes/Disk 1, then the "rm -rf" command would execute TWICE. It would look like this:

rm -rf /Volumes/Disk 1/Applications/iTunes.app 2< /dev/null

One of the commands (the second half, 'rm -rf 1/Applications/iTunes.app') would probably not do anything, since the path is invalid. The second command, though, could be brutal. 'rm -rf /Volumes/Disk' would delete the entire volume 'Disk' used in this example.

For those that had a problem, do you meet all the following criteria?

1. Did not delete iTunes 1.1
2. Had multiple volumes
3. Had similarly named volumes with spaces in their names

Any replies could help determine if this is, indeed, the cause of the problem.

I can't see how the "$2" variable is built, so this is all conjecture based on the evidence and looking at the "preflight" file. Obviously, there's an issue with the installer, since Apple has now pulled it ... but if you grabbed it already, I would highly recommend you do not use it, even if you don't appear to meet the criteria listed above. Just wait for a new installer from Apple, and keep your data safe!