We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,258 News Articles

Apple patches Safari 'carpet bomb' Windows bug

Bug could run unauthorised software on Windows PC

Apple has patched a bug in its Safari web browser after security researchers showed how it could be used to run unauthorised software on a Windows machine.

The 'carpet bomb' bug, which was originally discovered by security researcher Nitesh Dhanjani, was initially thought to be less serious than it turned out to be.

Dhanjani showed how Safari could be misused to litter a victim's desktop with downloaded programs, but two weeks after he disclosed his research, another hacker, named Aviv Raff, showed that this flaw could be exploited in tandem with other problems in Windows and Internet Explorer to run unauthorised software on a victim's PC.

That prompted Microsoft to issue its own warning about the issue. It also caused some security experts to caution web surfers about using Safari on the Windows platform.

According to Dhanjani, Apple initially told him that it did not intend to fix the issue, but apparently the company has now changed its mind.

Apple fixed the issue in the 3.1.2 version of its Safari browser for Windows, which was released yesterday afternoon. This update addresses a total of four security issues in Safari, including bugs in the way Safari renders JavaScript arrays and handles the downloading of executable files.

It also fixes a less-critical issue in the way Safari renders Bitmap and Gif images, which could give attackers a peek at the memory of a victim's computer, Apple said.

See also:

Visit PC Advisor's Apple spotlight for the latest Apple news and opinion

Thursday's update was for Windows computers only, and Apple has not yet released a 3.1.2 Safari update for the Mac.

The Mac version of Safari is also subject to the carpet bombing attack. But, unlike Windows, the Mac does not suffer from the second flaw, which allows a carpet bomb attack to be used to take control of a victim's machine. Also, Mac OS X squirrels downloaded files into a special folder, rather than depositing them on the desktop, making things a little safer on the Mac, Dhanjani said in an interview late Thursday.

He said it makes sense for Apple to fix the issue on Windows first because of the severity of this tandem attack. But he expects a Mac patch as well. "It's still a security issue," he said. "I would be very surprised if they don’t update it."

Dhanjani said that he hasn't heard from Apple since its initial response to his bug report.

Related articles:

Visit Security Advisor for the latest internet threat news, FREE net threat email newsletters, and internet security product reviews

IDG UK Sites

Best camera phone of 2015: iPhone 6 Plus vs LG G4 vs Galaxy S6 vs One M9 vs Nexus 6

IDG UK Sites

In defence of BlackBerrys

IDG UK Sites

Why we should reserve judgement on Apple ditching Helvetica in OS X/iOS for the Apple Watch's San...

IDG UK Sites

Retina 3.3GHz iMac 27in preview: Apple cuts £400 of price of Retina iMac with new model