We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

XP and Vista users open to 'carpet bomb' attack

Hacker posts IE and Safari attack code


A hacker has posted attack code that exploits critical flaws in Internet Explorer and Safari.

The source code, along with a demo of the attack, was posted Sunday on a computer security blog. It can be used to run unauthorised software on a victim's machine, and could be used by criminals in web-based computer attacks, security experts say.

Now that there is a public example of the attack code, Safari users running the Windows operating system should be concerned, said Eric Schultze, chief technical officer at Shavlik Technologies. "This is a bad thing. If you've got Safari, you're in trouble," he said.

The Safari bug, originally disclosed on May 15 by security researcher Nitesh Dhanjani, allows attackers to litter a victim's desktop with executable files, an attack known as "carpet bombing".

Two weeks later, security researcher Aviv Raff said that if this flaw is exploited in combination with bugs in Windows and Internet Explorer, attackers can run unauthorised software on a victim's computer.

Apple has reportedly said that it has no plans to patch the Safari flaw, but Microsoft released a security advisory on the problem on May 30, a sign that it may be working on a patch.

Microsoft's advisory says that the vulnerability has to do with the way Windows handles desktop executables and recommends that Windows users "restrict use of Safari as a Web browser until an appropriate update is available from Microsoft and/or Apple".

The attack affects all versions of Windows XP and Vista, Microsoft said in its advisory.


IDG UK Sites

Best iPad Air 2 and iPad mini 3 deals: Find the best contract for your new iPad

IDG UK Sites

The iPhone is doomed. Doomed to be marginally less successful than a very successful thing.

IDG UK Sites

How to prototype native mobile apps without writing code

IDG UK Sites

How to prepare for and update to OS X Yosemite: Get your Mac ready to download & install Apple's...