Flaws patched in Apple's Safari browser and iOS 6

Share this article:

Apple has released updates to address flaws in its Safari 6 web browser and iOS 6 mobile operating system.

The fixes were made available on Thursday and address two vulnerabilities in Safari 6.0.2. The bugs, which lie in WebKit, an open source web browser engine, could allow for “unexpected application termination or arbitrary code execution” if users visited a malicious website, according to Apple's summary of the flaws.

The browser update affects the OS X Lion and OS X Mountain Lion operating systems.

Updates for iOS 6.0.1 affecting iPhone 3GS, iPad 2 and the fourth-generation iPod Touch also addressed the same vulnerabilities, but for mobile users.

Other patches in iOS addressed a data disclosure bug, which could allow “maliciously crafted or compromised iOS applications” to determine addresses in the kernel, and a passcode-lock security issue, which could potentially allow attackers to bypass password requirements for Passbook – an iOS app that can store users' airline boarding passes, coupons, movie tickets, retailer reward cards and other mobile payment information.

Wolfgang Kandek, CTO at security firm Qualys, told SCMagazine.com on Friday that the WebKit bugs represented the most widespread threat to users.

“When you use Safari or Google Chrome, for instance, you are using WebKit as its underpinning,” Kandek said. “The attacks would be through a website that has something malicious on there that knows about the vulnerability, and it could run something on your machine that wants to take control of it. You probably wouldn't even notice [malware] that had been installed on your machine, which could feed information to an attacker.”

Chester Wisniewski, senior security advisor at security provider Sophos, also told SCMagazine.com on Friday that the WebKit fix appeared most critical.

“From a critical standpoint, I'd rate the WebKit issues highest because they affect Safari, Google Chrome and mobile users – and allow attackers to launch a drive-by exploit, which are most likely to be used by an attacker.”  

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Adobe exploit used to spread Dyre credential stealer

Adobe exploit used to spread Dyre credential stealer

Users running vulnerable Adobe software could be in danger of having credentials for Bitcoin websites stolen.

Staples is investigating a potential issue involving credit card data

Staples is investigating a potential issue involving credit ...

The company said it is investigating a potential issue involving credit card data and that customers are not responsible for fraudulent activity on cards if an issue is discovered.

Skills set a priority over legacy prejudices, experts say

Skills set a priority over legacy prejudices, experts ...

Cybersecurity expert Winn Schwartau and Robert Clark, a cyber law attorney at the Army Cyber Institute, discussed issues around hiring in the information security industry.