In the continuing effort by attackers to take advantage of a lack of awareness of Macintosh users another attack has emerged that needs user interaction. This can be successful since many Macintosh users tend to be less skeptical of files from unknown users. The Mac community for a long time has never really had to think about exploits, this is changing. In this case if a user opens an Illustrator file to take advantage of this vulnerability then it is possible for an attacker the continuing effort by attackers to take advantage of a lack of awareness of Macintosh users who tend to be less skeptical of files from unknown users. The Mac community for a long time has never really had to think about exploits, more and more we are identifying attack vectors that rely on some interaction from a user. If a user opens an Illustrator file to take advantage of this vulnerability then it is possible for an attacker to exploit the system. So, again if you do not trust the file do not open it, only open files from a known source and confirm the hash using md5 <filename in the terminal> or openssl sha1 <filename in terminal>.
This gets to a large issue of trust. Evidence is presented to a system or in this case a user that builds a case to trust the action or file. Explaining to a user that they must ask themselves has the file passed a certain amount of evidential benchmarks to trust the file. These benchmarks should be set by the information security policies. Procedures for validation should also be included. It would only be obvious to say that you one benchmark is knowing the party that sent the file.
More to come on trust...
CVE number: CVE-2008-3961