Apple addresses "carpet bomb" Safari for Windows threat

Share this article:
Apple on Thursday delivered a fix for the "carpet bomb" vulnerability in Safari for Windows, a bug that the computing giant initially maintained was not a security issue.

The vulnerability, reported last month by Ernst & Young security researcher Nitesh Dhanjani, was related to the fact that the web browser did not require user permission prior to a download. When he contacted Apple to report the issue, the company told him it did not intend to patch the glitch because it did not deem the bug a security concern.

Apple changed its mind when it issued Thursday's security update for Safari 3.1.2 for Windows.

"Saving an untrusted file to the Windows desktop may trigger the issue, and lead to the execution of arbitrary code," Apple said in its security update. "Web browsers are a means by which files may be saved to the desktop. To help mitigate this issue, the Safari browser has been updated to prompt the user prior to saving a download file."

What made the issue so serious was that the vulnerability could be exploited in concert with a bug in Internet Explorer, which concerns the way in which the Windows desktop handles executables, Joel Esler, volunteer for the SANS Internet Storm Center and a Mac expert, told on Friday.

Esler said a blended attack could occur if a victim visited a malicious website through the Safari for Windows browser. Users, in theory, could download a malicious DLL (dynamically linked library) to the desktop, without their permission, and then Internet Explorer would automatically execute the DLL.

"The two vulnerabilities together made one massive problem," he said.

Proof-of-concept exploit code had been published.

Microsoft, in a security advisory issued May 30, suggested users stop using Safari for Windows until Apple issued a fix.

"You can't just have Microsoft coming out and saying your browser is insecure," he said. "They've got to react. They've got to do something."

Thursday's security update from Apple includes fixes for three other, less critical vulnerabilities in Safari for Windows.

An Apple spokeswoman did not respond to a request for comment.
Share this article:

Sign up to our newsletters

More in News

Medical transcription provider settles data security charges

GMR Transcription Services in California agreed to settle FTC charges related to its security practices.

Researcher hacks network connected devices in own home

Researcher hacks network connected devices in own home

In his own home, a researcher was able to hack various network connected devices that are not computers and mobile phones.

Study: Most higher ed malware infections attributed to 'Flashback'

Study: Most higher ed malware infections attributed to ...

Flashback caused a stir in 2012 when some 650,000 Macs were infected with the malware.