Slashdot Mirror
Apple Fixes Safari "Carpet Bomb" Windows Vulnerability
Titoxd writes "Apple has released a new version of Safari that fixes the carpet bomb vulnerability in Safari 3.1 for Windows. This comes in the heels of Microsoft recommending against using Safari in Windows, as well as the release of code exploiting this vulnerability."
You think the carpet bombers did this?
Face it man, that rug really tied the room together...
Task Mangler
And my computer rebooted into OS X. Not that I mind, really.
Did they fix the bug where Safari installs as an iTunes update? I'd say that that is a fairly severe bug right there.
It's pretty common that some badly configured web server will send content to me that firefox will then ask if I want to download.
Just letting it download and then moving on to the next file is...well such an obviously stupid behaviour.
Also, please don't let carpet bombing become the next security buzzword along with bricking and zero-day.
Did Microsoft fix the vulnerability caused by Internet Explorer running with its current directory set to the Desktop and its library search path going through the Desktop? Because until they do that, the actual vulnerability in Windows that Safari made slightly easier to exploit still exists.
Safari downloads files (e.g. dynamic libraries) in user directories where the Internet Explorer could autoload them on start. Isn't the bigger problem within Internet Explorer? Why did Microsoft setup a library path to a user's directory at all?
So if she's a squirter then you have an IED on your hands?
All I know is if someone broke in my apartment and pissed all over my rug, I'd be pretty upset.
Microsoft's library path ALWAYS goes through the current directory. For some obscure reason that IE icon on the Desktop, the one that isn't a shortcut but is actually something special Microsoft added back in 1997 to make it harder to remove IE, runs IE on the Desktop instead of in the IE install directory, the way it would if it was a shortcut.
It's all a side effect of Microsoft's shenanigans when they tried to use browser-desktop integration to make an end-run around their agreement with the US DoJ. That they've convinced people that the big news is a bug in Safari that makes it slightly easier to take advantage of this problem is, well, bizarre.
And now you know the rest of the story.
While I am no Microsoft fan, I am amazed at the hubris of comments in this thread.
Surely anyone with half a brain HAS TO ADMIT that the Safari vulnerability is FAR WORSE than IE setting it's current path to the windows desktop.
In fact, the Safari vulnerability can be exploited for root access to the box without IE being in the equation AT ALL. Just pick some program or two that are likely to be installed on any user's computer ( iTunes, Firefox? ), and download .exe files with those names to the desktop. *BOOM*, next time someone wants to run iTunes or Firefox, if they click that exe by accident instead of their shortcut (how would they know any different? ), they're toast.
It isn't a mutually exclusive situation. There are two disparate vulnerabilities here. By themselves they aren't that big of a threat , but when used in concert the threat is greater than the sum of it's parts. You need the IE issue to load the compromised dll and you need Safari in order to "secretly" download the compromised dll in the first place.
The actual vulnerability is that Safari downloaded files without the user's permission.
Asking for permission before doing something that may potentially lead to a security exploit is no protection at all. Seriously. In the eight years between the time Microsoft introduced the browser-desktop merge, and the time I quit being a system admin and went back to programming, I had many many cases where some user (and these weren't dumb users, these were engineers and programmers with PhDs and patents to their name) would come to me and say "Peter, I just clicked the wrong button again, and I think I have a virus". That "again" is important. That means that they have the "Windows pops up stupid dialogs all the time so I have to approve this one" reflex burned into their cortex.
A user is not going to realize that a web page asking to download "someobscuregibberish.dll" is attacking them.
Stupid permission dialogs are no protection.
The actual vulnerability is twofold:
1. The path goes through the current directory by default, and it goes through the current directory first.
This is something that UNIX used to do, and it was widely recognized as a BAD idea by 1980. MS-DOS wasn't even out yet, let alone Windows.
2. The default download directory is the default directory of any program, let alone a program that is run virtually every time you log in.
This one is, well, beyond stupid. This is like having the mailslot in your front door connect to your safe deposit box. The directory that is MOST likely to contain malicious code is the one that you're MOST likely to be running code from on any given day.
Trying to make this a Windows issue smacks of fanboyism.
Name one other operating system or application where downloading files to the default download folder would cause them to be run, under any normal circumstances. The whole idea is completely insane.
By themselves they aren't that big of a threat
Um, yes, the IE flaw *is* that big of a threat. There is no circumstance where it should EVER be acceptable for a downloaded file, whether with permissions or not (who other than a geek is going to worry about downloading a file called "somethingobscure.dll"?), to be AUTOMATICALLY executed just because of the name it's given.
I hope Microsoft fixes it bloody quick.