Security researchers: Safari for Windows not so secure
Within hours of Apple's public release of the beta for Safari 3.0 for Windows, three security researchers independently found holes within the new browser. Researcher Aviv Raff highlighted in a blog post the company's product statement, that reads: "Apple's engineers designed Safari to be secure from day one." Raff found a vulnerability, a memory corruption error that could allow an attacker to insert malicious code on a Windows machine, within three minutes using publicly available fuzzing tools.
Security researcher David Maynor, posting on his Errata security blog, said he was also able to generate a memory corruption error "in no time." By the end of the day, he was able to generate a total of six bugs--four producing a denial of service (crash), and two capable of executing remote code.
Veteran security researcher Thor Larholm wrote in his blog that he found a "0day" vulnerability in Safari within two hours. The flaw exists in how Safari handles URL protocols within Windows, causing a denial of service (crash). Larholm has published an exploit to demonstrate the flaw.
All of the vulnerabilities were found on Windows machines; none of the researchers could say whether these flaws also existed on the Mac OS.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments. 
Watch Full-Disclosure mailing list for more info.
n3td3v
Well, if Apple wants to go mass PC, it's gonna be bitten. Congratulations to Microsoft... eh.
Wait till final, then let them have it.
The bigger problem I have with Apple is that they release horrible Windows software. iTunes is a bloated, often buggy mess. Quicktime is a file-association stealer, is really ugly, and fails to adopt any common Windows conventions, like being able to resize a Window from any side or corner (among others).
Also, when Apple introduces security flaws (as they have in the past with Quicktime and iTunes), rather than admitting that they can't write secure code better than anyone else, they blame the insecurity of Windows, and take forever to patch their bugs.
There are plenty of things to like about Apple, but their loathsome Windows software and arrogance about security problems will need to go if they're going to continue to grow.
greater share. the security through obscurity myth is so old and
oft disproved that repeating makes you look foolish to everyone
else.
did an company show otherwise? no. try reporting fact rather
than asking FUD.
while the Mac OS has millions of installs and no viruses in the
wild, Vista was hacked before it had 100,000 installs. that is
the reverse of security through obscurity...
IF safari is more prone to hacking on windows (i suspect it will
be) it will be due to the handling of calls in windows, and not in
the program itself. wait and see...
having fewer exploits and such than Linux and OS X. For
example, there were figures for the last 6 months of 2006 that
showed Windows had 39 vulnerabilities, Red Hat Linux had 208
and OS X had 43. It seems like Windows wins by quite a way,
until you look at the severity. Windows had 12 high priority
vulnerabilities, Red Hat Linux had 2 and OS X had 1. In essence
you're more vulnerable to having your browser or email client
crash on Linux or OS X but more vulnerable to having data loss,
your system taken over etc on Windows
"but the bugs found in the beta copy of Safari on Windows work on the production copy on OSX as well"
That is not a beta problem.
When all the bugs get worked out, its gonna be a KILLER APP!
the fun'.
I'm not suggesting Microsoft's software is better than Apple here. I'm just saying you Apple fanboys need to think a little bit before dumping on Microsoft.
"Those who know Windows best, like it least".
-Sean
Quote from this link:
I can't speak for anybody else but the bugs found in the beta copy of Safari on Windows work on the production copy on OSX as well (same code base for alot of stuff). The exploit is robust mostly thanks to the lack of any kind of adanced security features in OSX, I write about it here.
who STILL hasn't shown his supposed wifi hack.
until someone reputable says the same thing, this is BS.....
Oh, and it's beta folks, on Windows.
Once the bugs are worked out, it might just be my browser on the PC. Plus it's still my browser on the Mac as the security issues haven't affected me.
That most hacks and exploits are through Applications and not the OS.
And this might also show that Apple is not the best designer of programs, they really never have been.
Remember what they keep telling us, they are a HARDWARE COMPANY!! lol
experienced Mac user knows it has its flaws. However, what is
commonly said, and I have found this to be true, is that the
flaws tend to to be less hampering than on windows. Most
"flaws" in the UI of OS X are just oversights indesign that can be
fixed through updates. For this little bit of trouble, you get a
more robust OS that has the comfort of a, may the Mac Gods
forgive me, windows comparable GUI yet the power of a
command line driven OS.
Next, yes we are going to remind you that this is beta software.
This is in fact the purpose of releasing software to the public in
beta form. To find all of the bugs that you can't work out in a
lab. What has happened is that new age companies like Google
have ruined the term beta by leaving their finished software
labeled as beta. Now, everyone thinks that just because it says
beta doesn't mean that it won't run well. That is exactly what
beta means. It will not run as well as the finished product you
are expecting.
As a note, I am using Safari 3 on my Mac and I have only found
one bug so far. On some pages, when you download a web
based PDF file the browser quits. However, I have not seen this
enough to say that it is the browser and not the sites. Anybody
know anything about this?
- Can I believe my eyes
- by andrew77uk June 15, 2007 4:55 AM PDT
- Of course its buggy its beta, and like stated before, the point of beta software is to iron out bugs. Someone asked does apple have nothing better to do? Well yes probably, but think out side the box. Releasing mac apps on the pc is great marketing for apple, the safari version on the mac will have more features, and if people like safari enough it my spark their interest in looking to get an apple mac.
- Like this Reply to this comment
-
(32 Comments)