Slashdot Mirror

← Back to Stories (view on slashdot.org)

Apple Fixes Safari "Carpet Bomb" Windows Vulnerability

Posted by kdawson on from the no-more-carpet-tax dept.

Titoxd writes "Apple has released a new version of Safari that fixes the carpet bomb vulnerability in Safari 3.1 for Windows. This comes in the heels of Microsoft recommending against using Safari in Windows, as well as the release of code exploiting this vulnerability."

6 of 99 comments (clear)

  1. Re:But did they fix the real bug? by tokul · · Score: 5, Informative

    Did they fix the bug where Safari installs as an iTunes update?
    New (released more than one month ago) Apple Software Update has two sections. One for updates and other for new software. When Safari was introduced, Software Update had only one section.
  2. Yes, the flaw is in IE. by argent · · Score: 4, Informative

    Microsoft's library path ALWAYS goes through the current directory. For some obscure reason that IE icon on the Desktop, the one that isn't a shortcut but is actually something special Microsoft added back in 1997 to make it harder to remove IE, runs IE on the Desktop instead of in the IE install directory, the way it would if it was a shortcut.

    It's all a side effect of Microsoft's shenanigans when they tried to use browser-desktop integration to make an end-run around their agreement with the US DoJ. That they've convinced people that the big news is a bug in Safari that makes it slightly easier to take advantage of this problem is, well, bizarre.

    And now you know the rest of the story.

  3. Re:But did they fix the real bug? by Briareos · · Score: 3, Informative

    New (released more than one month ago) Apple Software Update has two sections. One for updates and other for new software. Last I checked the "new" software was still checked by default - and I really don't feel like installing anything that ASU comes with right now. So does anyone know if they finally fix THAT idiocy?

    np: Seabear - Sailors Blue (The Ghost That Carried Us Away)

    --

    "I'm not anti-anything, I'm anti-everything, it fits better." - Sole

  4. You are both right. by nobodyman · · Score: 2, Informative

    It isn't a mutually exclusive situation. There are two disparate vulnerabilities here. By themselves they aren't that big of a threat , but when used in concert the threat is greater than the sum of it's parts. You need the IE issue to load the compromised dll and you need Safari in order to "secretly" download the compromised dll in the first place.

  5. Re:What a stupid vulnerability by tlhIngan · · Score: 3, Informative

    Apple's solution is to let things download, but put them in the downloads folder and flag them as untrusted content from the internet (well not flag them as trusted, since the default is untrusted). That is to say, that is their solution on OS X. On Windows, there is no download folder and for some reason they screwed up and did not flag it as untrusted in Vista (XP does not support that either). In my mind, their solution on OS X is superior, because it also helps solve the problem of executables masquerading as data.

    Actually, Windows has this as well.

    If you download a file using Internet Explorer, an NTFS file attribute is set that marks it as "downloaded - untrusted". Double click the file and you get a popup asking "DO you want to run this executable?" with a popup and showing the executable properties (signed by, etc). Problem is, it requires that you run NTFS, and if you copy the file to a network server, that network server to support extended attributes. Use Firefox or other browser, and the attribute isn't set, or copy to a fileserver that doesn't support extended attributes, and it's lost.

    (Most frustrating when you have to apply 12+ patches to a program that Microsoft Update doesn't have support for. I wrote a little bash script that shells out cmd.exe (was an MSI file) to do this, but you're still left with these popups).

    As for OS X, I believe these notifications started in Leopard. They too are extended attributes, I believe. Though I think OS X copies attributes to filesystems/servers that don't support them by using dotfiles, so copying the file around doesn't get rid of it. (It goes away after you've approved it, though. No reason why Apple couldn't figure out what flag IE sets and have Safari do same on Windows, either.

  6. Re:What a stupid vulnerability by Shados · · Score: 2, Informative

    Actually, Vista -does- have a specific Download folder now, for the record.