Apple addresses "carpet bomb" Safari for Windows threat

Share this article:
Apple on Thursday delivered a fix for the "carpet bomb" vulnerability in Safari for Windows, a bug that the computing giant initially maintained was not a security issue.

The vulnerability, reported last month by Ernst & Young security researcher Nitesh Dhanjani, was related to the fact that the web browser did not require user permission prior to a download. When he contacted Apple to report the issue, the company told him it did not intend to patch the glitch because it did not deem the bug a security concern.

Apple changed its mind when it issued Thursday's security update for Safari 3.1.2 for Windows.

"Saving an untrusted file to the Windows desktop may trigger the issue, and lead to the execution of arbitrary code," Apple said in its security update. "Web browsers are a means by which files may be saved to the desktop. To help mitigate this issue, the Safari browser has been updated to prompt the user prior to saving a download file."

What made the issue so serious was that the vulnerability could be exploited in concert with a bug in Internet Explorer, which concerns the way in which the Windows desktop handles executables, Joel Esler, volunteer for the SANS Internet Storm Center and a Mac expert, told on Friday.

Esler said a blended attack could occur if a victim visited a malicious website through the Safari for Windows browser. Users, in theory, could download a malicious DLL (dynamically linked library) to the desktop, without their permission, and then Internet Explorer would automatically execute the DLL.

"The two vulnerabilities together made one massive problem," he said.

Proof-of-concept exploit code had been published.

Microsoft, in a security advisory issued May 30, suggested users stop using Safari for Windows until Apple issued a fix.

"You can't just have Microsoft coming out and saying your browser is insecure," he said. "They've got to react. They've got to do something."

Thursday's security update from Apple includes fixes for three other, less critical vulnerabilities in Safari for Windows.

An Apple spokeswoman did not respond to a request for comment.
Share this article:

Sign up to our newsletters

More in News

AOL Mail hack furthers spam campaign using spoofed accounts

AOL confirmed on Monday that it was aware of the issue and working to remediate the situation.

Backdoors in Wi-Fi routers, said to be closed, can be reopened

Backdoors in Wi-Fi routers, said to be closed, ...

Although said to be patched, researcher Eloi Vanderbeken discovered during the Easter holiday that backdoors existing in certain wireless routers can be reactivated.

Apple ships Mac OS X updates, fixes several code execution bugs

Apple ships Mac OS X updates, fixes several ...

Among the addressed vulnerabilities, was a bug affecting WindowServer, which could allow an attacker to execute malicious code outside the sandbox.