Slashdot Mirror
Apple Fixes Safari "Carpet Bomb" Windows Vulnerability
Titoxd writes "Apple has released a new version of Safari that fixes the carpet bomb vulnerability in Safari 3.1 for Windows. This comes in the heels of Microsoft recommending against using Safari in Windows, as well as the release of code exploiting this vulnerability."
You think the carpet bombers did this?
Face it man, that rug really tied the room together...
Task Mangler
And my computer rebooted into OS X. Not that I mind, really.
Did they fix the bug where Safari installs as an iTunes update? I'd say that that is a fairly severe bug right there.
It's pretty common that some badly configured web server will send content to me that firefox will then ask if I want to download.
Just letting it download and then moving on to the next file is...well such an obviously stupid behaviour.
Also, please don't let carpet bombing become the next security buzzword along with bricking and zero-day.
Did Microsoft fix the vulnerability caused by Internet Explorer running with its current directory set to the Desktop and its library search path going through the Desktop? Because until they do that, the actual vulnerability in Windows that Safari made slightly easier to exploit still exists.
Safari downloads files (e.g. dynamic libraries) in user directories where the Internet Explorer could autoload them on start. Isn't the bigger problem within Internet Explorer? Why did Microsoft setup a library path to a user's directory at all?
So if she's a squirter then you have an IED on your hands?
All I know is if someone broke in my apartment and pissed all over my rug, I'd be pretty upset.
Seriously. They're not used to so many vulnerabilities. Eventually they'll be like, screw this insecure OS. We're only coding for our own.
Microsoft's library path ALWAYS goes through the current directory. For some obscure reason that IE icon on the Desktop, the one that isn't a shortcut but is actually something special Microsoft added back in 1997 to make it harder to remove IE, runs IE on the Desktop instead of in the IE install directory, the way it would if it was a shortcut.
It's all a side effect of Microsoft's shenanigans when they tried to use browser-desktop integration to make an end-run around their agreement with the US DoJ. That they've convinced people that the big news is a bug in Safari that makes it slightly easier to take advantage of this problem is, well, bizarre.
And now you know the rest of the story.
While I am no Microsoft fan, I am amazed at the hubris of comments in this thread.
Surely anyone with half a brain HAS TO ADMIT that the Safari vulnerability is FAR WORSE than IE setting it's current path to the windows desktop.
In fact, the Safari vulnerability can be exploited for root access to the box without IE being in the equation AT ALL. Just pick some program or two that are likely to be installed on any user's computer ( iTunes, Firefox? ), and download .exe files with those names to the desktop. *BOOM*, next time someone wants to run iTunes or Firefox, if they click that exe by accident instead of their shortcut (how would they know any different? ), they're toast.
Except Safari follows future standards (CSS 3, for example) instead of making up it's own random "standards" like IE 6 did.
It isn't a mutually exclusive situation. There are two disparate vulnerabilities here. By themselves they aren't that big of a threat , but when used in concert the threat is greater than the sum of it's parts. You need the IE issue to load the compromised dll and you need Safari in order to "secretly" download the compromised dll in the first place.
More and more managers are behaving as if following the example of the Bill & Steve act is actually good business.
Nothing new about it, read about it in the history of Rome and earlier, as far back as we can read history about nations warring against each other, in fact.
Money is like pus. It collects at wounds, and collects faster at dirty wounds.
The actual vulnerability is that Safari downloaded files without the user's permission.
Asking for permission before doing something that may potentially lead to a security exploit is no protection at all. Seriously. In the eight years between the time Microsoft introduced the browser-desktop merge, and the time I quit being a system admin and went back to programming, I had many many cases where some user (and these weren't dumb users, these were engineers and programmers with PhDs and patents to their name) would come to me and say "Peter, I just clicked the wrong button again, and I think I have a virus". That "again" is important. That means that they have the "Windows pops up stupid dialogs all the time so I have to approve this one" reflex burned into their cortex.
A user is not going to realize that a web page asking to download "someobscuregibberish.dll" is attacking them.
Stupid permission dialogs are no protection.
The actual vulnerability is twofold:
1. The path goes through the current directory by default, and it goes through the current directory first.
This is something that UNIX used to do, and it was widely recognized as a BAD idea by 1980. MS-DOS wasn't even out yet, let alone Windows.
2. The default download directory is the default directory of any program, let alone a program that is run virtually every time you log in.
This one is, well, beyond stupid. This is like having the mailslot in your front door connect to your safe deposit box. The directory that is MOST likely to contain malicious code is the one that you're MOST likely to be running code from on any given day.
Trying to make this a Windows issue smacks of fanboyism.
Name one other operating system or application where downloading files to the default download folder would cause them to be run, under any normal circumstances. The whole idea is completely insane.
Even though someone else said it already, I'm going to try to make it glaringly obvious for all the mods that modded you up insightful or whatever --
In the unix world, we learned a long time ago not to put the home directory or the current working directory in the default executable path variable. The reasons were known before MS-Dos was a product, although there were still some *nix products from the less savvy vendors that had .profile put "." in "$PATH" when MSWindows95 became a product.
Reputable *nix vendors have had that fixed for at least a decade.
There is only one MSWindwsXXX vendor, and they still leave the path effectively set up to include a place where downloading, drive-by or otherwise, tends to drop things.
That's a no-no for all the user-clicks-through reasons being cited.
Safari's bug was just a Denial-Of-Service type of bug without this design flaw in MSWindows.
By themselves they aren't that big of a threat
Um, yes, the IE flaw *is* that big of a threat. There is no circumstance where it should EVER be acceptable for a downloaded file, whether with permissions or not (who other than a geek is going to worry about downloading a file called "somethingobscure.dll"?), to be AUTOMATICALLY executed just because of the name it's given.
I hope Microsoft fixes it bloody quick.
We had regular warnings about not adding "." to $PATH when I was at Berkeley... in 1978.
The fact that I'm replying at all is a testament to the quality of the ACs troll.
I just spent 2 hours getting div transparencies to work with IE 6. The Safari and Firefox portions took a few minutes. Getting it to work in IE6 was a royal pain. To compound the problem, IE6 also doesn't support PNG alpha channels.
With any luck, IE6 will go the way of the dodo bird soon enough and I won't have to worry about it anymore.
Just pick some program or two that are likely to be installed on any user's computer ( iTunes, Firefox? ), and download .exe files with those names to the desktop. *BOOM*, next time someone wants to run iTunes or Firefox, if they click that exe by accident instead of their shortcut (how would they know any different? ), they're toast.
This is called a "social engineering attack".
You don't need Safari to do this. People have been "phished" by this kind of attack as long as there have been desktop operating systems.
The thing is, you can learn not to be social engineered.
If you can stick a file some place the *operating system* trusts it, however, even if the user gets asked "is it OK for me to download obscurecrap.dll", you're home free. And it's a LOT easier to social-engineer people to approve a dialog than to get them to click on the wrong icon... particularly when more people will notice a second iTunes icon on the desktop than give "obscurecrap" a second glance.
Social engineering attacks are FAR less dangerous than automatic execution ones.
But while I think about it... that business of hiding the file type, Microsoft? How about you don't do that, OK? It makes phishing easier. Oh, you too Apple, I'm looking at you as well.
Oh, and Microsoft, what kind of fucked up idea was it to make the desktop the default download location in the first place? That didn't used to be standard, I used to find that stuff in a "downloads" folder, but everyone copies you even when you're doing something really stupid like that.
Like I said before, there is no social engineering required *AT ALL*. Just pick a common application name and odds are they already have it installed and it *WILL* be clicked.
What do you think social engineering *means*?
You CAN learn not to be social engineered.
It's a LOT harder to learn when it's OK to approve one of Windows myriad stupid "security theatre" dialogs.
In the decade that I was a WIndows network admin, I would ROUTINELY have people who came by and say "peter, I clicked on the wrong button again and I think I have a virus". That again is critical.
I've also had people say they'd been tricked into running a program (from the desktop in some cases, back when there was less paranoia about downloads) but only one person was ever caught that way twice.
Clicking "OK" when the computer pops up "Internet Explorer wants to detonate your monitor"? You bet. That's a passive response to a dialog they've been trained to approve. Running a program, even when it was disguised as a document or another kind of icon (because the kind of attack you're talking about is NOT new)? That's a lot harder to depend on.
Almost everyone CAN learn not to be social-engineered, once you eliminate that reflex reaction.
For example, if you hit WIN+R and type 'CMD", the desktop is your default working directory.
Wrong. It's your profile, the parent directory of your desktop.
And virtually no GUI applications on Windows EVER change their current working directory.
No one should give a rat's ass what the working directory of any application is
True. The current working directory should not be in the search path for applications or DLLs.
Namely, you should not be storing .EXE or .DLL file son your desktop for any reason
Wrong. That is depending on not having dangerous stuff in your current working directory. If the downloads were to %PROFILE%\Downloads then you'd be in trouble if you ran a program from that directory.
Again, and UNIX developers figured this one out back before Microsoft shipped copy #1 of MS-DOS, the current directory should not be in any executable search path.
I am subscribed to Apple security mailing list, I recommend it to everyone. It is less BS, plain text alert about anything related to security update released from Apple. They mail immediately too even beating software update. It is both for OS X and Windows.
http://lists.apple.com/mailman/listinfo/security-announce
I noticed something really bothers me as OS X only user:
http://lists.apple.com/archives/Security-announce/2008/Jun/msg00001.html
"Impact: Saving untrusted files to the Windows desktop may lead to
the execution of arbitrary code
Description: An issue exists in how the Windows desktop handles
executables. Saving an untrusted file to the Windows desktop may
trigger the issue, and lead to the execution of arbitrary code."
No, Windows Desktop always running something based on its extension is not an issue, it is how Windows works. Is it backwards? Well, it is but it is THEIR OS. Should MS add "This is executable" to some OS X file (via Unix perm or Resource and extension) and blame Apple like "An issue exists how OS X handles files" for their fault?
It is understandable for a company like Apple to let PR team do the final edit on security bulletins but they shouldn't use it like a childish way like that. At least on security list. Also putting Windows issues to first "page" and OS X issues to down below is a real cheap trick. Not on that message, it happened several times when multiple OS issues have arisen.
+4 Insigh... WHAT?
The bigger vulnerability is an internet facing application with the user's desktop (first) in it's library search path.
Jesus Tap Dancing Christ how can you all miss this? .: /lib/usr/lib" /lib/usr/lib: ." /lib/usr/lib: ."
Most of you know PATH="." is bad right? Well, if you don't, get off Slashdot NOW.
Windows used to have this equivalent:
LDPATH="$PATH:
In XP on it's now
LDPATH="$PATH:
Well, at least the user writable directory is last..
Now imagine that Firefox runs with LDPATH="~/Desktop:
HOW CAN THAT NOT BE HORRIBLY, HORRIBLY BAD?
Mod this joker down.