Apple Safari vulnerable to multiple attacks
Safari users may be subject to crashes or interactions with an attacker's malicious site, according to a warning posted on Tuesday on BugTraq .
Researcher Juan Pablo Lopez Yacubian is credited with finding multiple vulnerabilities in Apple Safari 3.1.1 for Windows. Other versions of Safari may also be affected.
Among the vulnerabilities cited are a denial-of-service (crash) vulnerability caused by a write-access violation, a denial-of-service (crash) vulnerability caused by a read-access violation, and a third vulnerability that allows attackers to spoof the content contained in the address bar. A full write up can be found here .
In a separate mailing to Bugtraq, Juan Pablo Lopez Yacubian says he was also able to use a similar exploit to crash Mozilla Firefox 3 beta 5.
That said, the general workaround is not to use Safari 3.1.1 for Windows until Apple issues a fix. Versions of Firefox 2.x and Opera are recommended.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments.
creates such a **** poor site it would take up too many
resources on my machine, I'm happy to have the browser crash
as a defense. What's the problem? You just, you know, reload
the browser and move on?
Now, if it crashed the whole computer, I'd be pissed. And that
would happen in some cases if the browser wasn't smart enough
to crash first. We'll see if that happens in the real world.
But the only thing that ever crashes my Mac completely is faulty
network disk access, a problem with OSX since 10.0 that has
been mitigated in 10.5, but is still there.
malpunks out there causing trouble, but crashing the browser isn't
the end of the world. destroying my HD, rewriting all my word files
with "Paul for President", etc., that would be much worse.
Most crashes I've seen in a browser were directly due to a plugin like javaRE or activex control like flash.
If they were, you would spend all your time reporting on Flash and Silverlight "attacks".
Yet if the same thing happened on a Windows box, they would use it as 'proof' of MS's ineptness.
Apple fans start with the premise that Apple is never wrong, then warp the 'facts' to fit. At times like this, it is pretty funny to watch
Huh? There are only four comments posted before yours, from
three people. Only one commenter says that she prefers the
browser crashing than getting the machine compromised.
So, for you, a sample of one is enough to support your claim?
But I'd still use Mac over any version of Windows.
- Safari is a joke gone bad...
-
by AppleSuxLeo
April 24, 2008 6:16 PM PDT
- Mr.Turtle Neck`s version of an April Fools joke.
-
Reply to this comment
-
(12 Comments)