Ahh,,, "safari" bug

By , June 1, 2008 10:12 pm

Safari Flaw Worse Than First Thought, Microsoft Warns
This
article
in PC World cracks me up. The Safari bug can cause software to be downloaded – not run – just downloaded. It is referred to as a “carpet bombing bug” because it litters the desktop with files that can be executed. A separated Internet Explorer bug, which was reported to Microsoft more than a year ago – causes the potentially malicious software to be run.

Now, Safari is the the Apple computer browser. Microsoft – the king of insecurity – is warning us about a flaw in the Apple web browser that can cause problems for Microsoft Windows computers. Sounds shoddy – what’s wrong with Apple that their software is causing problems for those wonderful Microsoft computers? As it turns out … nothing:


It turns out that if this flaw is exploited in combination with a second unpatched bug in Internet Explorer, attackers can run unauthorized software on a victim’s computer, according to Aviv Raff, a security researcher. Raff says he originally reported the IE flaw to Microsoft more than a year ago, and then told them about how it could be combined with the carpet bombing bug just over a week ago.

IDG News Service tested Raff’s demonstration attack code, which runs Windows Calculator on a victim’s system. For the attack to work, a victim must first visit a maliciously crafted Web page with the Safari browser, which in turn will trigger the carpet bombing attack and exploit the IE flaw.



So as I see it, Microsoft has had a serious known bug for more than one year that can cause arbitrary programs to be executed without the users permission. Apple has another bug that was recently discovered – which allows files to be downloaded to the computer – which are then run by the Microsoft bug.

What we have here is a moderate Apple bug and a major serious Microsoft Internet Explorer bug. Microsoft is trying to deflect attention from it’s own more serious flaws and trying to make Apple look bad.

Leave a Reply

Panorama Theme by Themocracy

Switch to our mobile site