Da ist es ja schon: Apple Security Update 2004-06-07 [Update]

Per Software Aktualisierung; 1,3 MB groß:
Security Update 2004-06-07 delivers a number of security enhancements and is recommended for all Macintosh users. This update includes the following components:
DiskImages
LaunchServices
Safari
Terminal
Mac OS X will now present an approval alert when an application is to be run for the first time either by opening a document or clicking on a URL related to the application.

Das sieht gut aus, Apple scheint sich allen bekannten Lücken angenommen zu haben, weitere Informationen finden sich in diesem Knowledge Base Artikel:
"This system component has been modified to only open applications that have previously been explicitly run on the system. Attempts to run an application that has not previously been explicitly run will result in a user alert." Mehr dazu auch hier. Und: "The registration of the disk:// URI type is removed from the system as a preventative measure against attempts to automatically mount remote disk image file systems."

Zusätzlich in der Knowledge Base: 'Safety tips for handling email attachments and content downloaded from the Internet'.

Update:
Die verbleibenden Lücken sind damit geschlossen, ich habe meine Anleitung entsprechend aktualisiert. Bleibt zu hoffen, dass Apple tatsächlich aus dem Kommunikationsdebakel lernt: "Schiller said Apple would accept criticism on communicating with its customers and improve the language in the updates beginning with the one issued today. Apple is also placing the URL for its security Web site in related software updates to make people more aware of resources that are -- and have been for some time -- available to them."