Apple addresses "carpet bomb" Safari for Windows threat

Share this article:
Apple on Thursday delivered a fix for the "carpet bomb" vulnerability in Safari for Windows, a bug that the computing giant initially maintained was not a security issue.

The vulnerability, reported last month by Ernst & Young security researcher Nitesh Dhanjani, was related to the fact that the web browser did not require user permission prior to a download. When he contacted Apple to report the issue, the company told him it did not intend to patch the glitch because it did not deem the bug a security concern.

Apple changed its mind when it issued Thursday's security update for Safari 3.1.2 for Windows.

"Saving an untrusted file to the Windows desktop may trigger the issue, and lead to the execution of arbitrary code," Apple said in its security update. "Web browsers are a means by which files may be saved to the desktop. To help mitigate this issue, the Safari browser has been updated to prompt the user prior to saving a download file."

What made the issue so serious was that the vulnerability could be exploited in concert with a bug in Internet Explorer, which concerns the way in which the Windows desktop handles executables, Joel Esler, volunteer for the SANS Internet Storm Center and a Mac expert, told SCMagazineUS.com on Friday.

Esler said a blended attack could occur if a victim visited a malicious website through the Safari for Windows browser. Users, in theory, could download a malicious DLL (dynamically linked library) to the desktop, without their permission, and then Internet Explorer would automatically execute the DLL.

"The two vulnerabilities together made one massive problem," he said.

Proof-of-concept exploit code had been published.

Microsoft, in a security advisory issued May 30, suggested users stop using Safari for Windows until Apple issued a fix.

"You can't just have Microsoft coming out and saying your browser is insecure," he said. "They've got to react. They've got to do something."

Thursday's security update from Apple includes fixes for three other, less critical vulnerabilities in Safari for Windows.

An Apple spokeswoman did not respond to a request for comment.
Share this article:

Sign up to our newsletters

More in News

Five schools earn NSA's excellence in cyber ops distinction

The schools earned NSA's Centers for Academic Excellence designation for their cyber offerings.

With RATs at their disposal, 419 scammers target businesses

With RATs at their disposal, 419 scammers target ...

A new report reveals how Nigeria's 419 scammers are spreading malware to pocket business funds.

InfoSec pros worried BYOD ushers in security exploits, survey says

InfoSec pros worried BYOD ushers in security exploits, ...

A study by the Information Security Community on LinkedIn found most organizations don't have proper polices and support for BYOD.