Skip to main content

Mac software > News

Fri, 20 Jun 2008 Apple fixes Safari 'carpet bomb' bug

Apple has reversed its position and patched the "carpet bombing" flaw in its Safari browser.

Robert McMillan

  • Email to a friend
  • Print this article
  • Bookmark this page
  • RSS feed

Apple has reversed course and patched a bug in its Safari browser after security researchers showed how it could be used to run unauthorized software on a Windows machine.

The "carpet bomb" bug, which was originally discovered by security researcher Nitesh Dhanjani, was initially thought to be less serious than it turned out to be.

Dhanjani showed how Safari could be misused to litter a victim's desktop with downloaded programs, but two weeks after he disclosed his research, another hacker, named Aviv Raff, showed that this flaw could be exploited in tandem with other problems in Windows and Internet Explorer to run unauthorized software on a victim's PC.

That prompted Microsoft to issue its own warning about the issue. It also caused some security experts to caution surfers about using Safari on the Windows platform.

According to Dhanjani, Apple initially told him that it did not intend to fix the issue, but apparently the company has now changed its mind.

Apple fixed the issue in the 3.1.2 version of its Safari browser for Windows, which was released Thursday afternoon. This update addresses a total of four security issues in Safari, including bugs in the way Safari renders JavaScript arrays and handles the downloading of executable files.

It also fixes a less-critical issue in the way Safari renders Bitmap and Gif images, which could give attackers a peek at the memory of a victim's computer, Apple said.

Thursday's update was for Windows computers only, and Apple has not yet released a 3.1.2 Safari update for the Mac.

Email A Friend

Email this article to a friend or colleague:



PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

<<prev article | back to news index | next article>>

Question of the day!

Mark Hattersley
Editor in Chief

Do you share your creations online?

Question of the day!

Do you share your creations online?

% of Macworld readers agree with you

Yes
TBC
No
TBC

What do you create and how do you share it?

124 characters remaining

Follow the conversation at @TabletChat

paintings & illustrations, mostly, which i upload to flickr.RT @fragmentedm

I draw manga/anime characters. I also do graphic design and photography.RT @spialelo

Yes. I usually put them up on my #deviantart account for feedback on how to improve.RT @spialelo

Latest News


More news...