Slashdot Mirror
Apple Fixes Safari "Carpet Bomb" Windows Vulnerability
Titoxd writes "Apple has released a new version of Safari that fixes the carpet bomb vulnerability in Safari 3.1 for Windows. This comes in the heels of Microsoft recommending against using Safari in Windows, as well as the release of code exploiting this vulnerability."
You think the carpet bombers did this?
Face it man, that rug really tied the room together...
Task Mangler
And my computer rebooted into OS X. Not that I mind, really.
Did they fix the bug where Safari installs as an iTunes update? I'd say that that is a fairly severe bug right there.
Safari downloads files (e.g. dynamic libraries) in user directories where the Internet Explorer could autoload them on start. Isn't the bigger problem within Internet Explorer? Why did Microsoft setup a library path to a user's directory at all?
So if she's a squirter then you have an IED on your hands?
All I know is if someone broke in my apartment and pissed all over my rug, I'd be pretty upset.
Microsoft's library path ALWAYS goes through the current directory. For some obscure reason that IE icon on the Desktop, the one that isn't a shortcut but is actually something special Microsoft added back in 1997 to make it harder to remove IE, runs IE on the Desktop instead of in the IE install directory, the way it would if it was a shortcut.
It's all a side effect of Microsoft's shenanigans when they tried to use browser-desktop integration to make an end-run around their agreement with the US DoJ. That they've convinced people that the big news is a bug in Safari that makes it slightly easier to take advantage of this problem is, well, bizarre.
And now you know the rest of the story.
The actual vulnerability is that Safari downloaded files without the user's permission. Trying to make this a Windows issue smacks of fanboyism.
Certainly not for the average Slashdot user and arguably not for anyone. Safari won't overwrite a user's existing icons, just add new ones. I also opens a download manager so users know something is being added. There are some pretty ignorant users out there, but not many that won't take not that some random Web site is downloading something called "Firefox.exe" to their desktop with an icon that looks just like their Web browser's. Finally, I notice you use the present tense. The ability to do this in Safari has been fixed, whereas the flaw with Windows has not. So, yeah I'd say the flaw in Windows is currently a FAR WORSE vulnerability, as you put it.
The main thing here, is the Safari flaw requires user interaction to work by itself, which means you have to manage a social engineering feat and get people to do something (double click and icon). With the flaw in Windows, any download from any source that they can get on a user's desktop can be automatically run.
Actually, Windows has this as well.
If you download a file using Internet Explorer, an NTFS file attribute is set that marks it as "downloaded - untrusted". Double click the file and you get a popup asking "DO you want to run this executable?" with a popup and showing the executable properties (signed by, etc). Problem is, it requires that you run NTFS, and if you copy the file to a network server, that network server to support extended attributes. Use Firefox or other browser, and the attribute isn't set, or copy to a fileserver that doesn't support extended attributes, and it's lost.
(Most frustrating when you have to apply 12+ patches to a program that Microsoft Update doesn't have support for. I wrote a little bash script that shells out cmd.exe (was an MSI file) to do this, but you're still left with these popups).
As for OS X, I believe these notifications started in Leopard. They too are extended attributes, I believe. Though I think OS X copies attributes to filesystems/servers that don't support them by using dotfiles, so copying the file around doesn't get rid of it. (It goes away after you've approved it, though. No reason why Apple couldn't figure out what flag IE sets and have Safari do same on Windows, either.
How did safari even get on most of those computers. I think people are seriously missing the big issue here.
Imagine if Netscape won the browser wars and you installed Windows Media Player which later on, in the middle of then night, downloaded and installed IE for you. If Office 2008 did this on OSX there would be riots in the street. When Apple does it, its of course Microsoft's fault.
Granted, there's a lot of blame to go around, but claiming this is a MS problem is being pretty unfair and only shows up that Apple can do anything, and few will complain.
The actual vulnerability is that Safari downloaded files without the user's permission.
Asking for permission before doing something that may potentially lead to a security exploit is no protection at all. Seriously. In the eight years between the time Microsoft introduced the browser-desktop merge, and the time I quit being a system admin and went back to programming, I had many many cases where some user (and these weren't dumb users, these were engineers and programmers with PhDs and patents to their name) would come to me and say "Peter, I just clicked the wrong button again, and I think I have a virus". That "again" is important. That means that they have the "Windows pops up stupid dialogs all the time so I have to approve this one" reflex burned into their cortex.
A user is not going to realize that a web page asking to download "someobscuregibberish.dll" is attacking them.
Stupid permission dialogs are no protection.
The actual vulnerability is twofold:
1. The path goes through the current directory by default, and it goes through the current directory first.
This is something that UNIX used to do, and it was widely recognized as a BAD idea by 1980. MS-DOS wasn't even out yet, let alone Windows.
2. The default download directory is the default directory of any program, let alone a program that is run virtually every time you log in.
This one is, well, beyond stupid. This is like having the mailslot in your front door connect to your safe deposit box. The directory that is MOST likely to contain malicious code is the one that you're MOST likely to be running code from on any given day.
Trying to make this a Windows issue smacks of fanboyism.
Name one other operating system or application where downloading files to the default download folder would cause them to be run, under any normal circumstances. The whole idea is completely insane.