toggle

AAPL Stock: 111.78 ( -0.87 )

Printed from http://www.macnn.com

Apple hardens Safari for Windows

updated 02:10 pm EDT, Wed August 1, 2007

Safari update for Windows

Apple has issued an update to its Safari Web browser for Windows in an effort to beef up security. The patch fixes several vulnerabilities related to adding bookmarks, visiting malicious websites, Java applets, and URL masquerading. Apple's update applies fixes to Safari and WebKit, plugging a total of four holes. The specific risks include adding bookmarks, visiting a malicious website, and accessing URLs with look-alike characters to load a different page than the user expects.

Apple has offered details on the security fixes:

Safari

A stack buffer overflow vulnerability exists in Safari's bookmark handling. By enticing a user to add a bookmark with an overlong title, an attacker may trigger the issue which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing proper bounds checking. This issue does not affect Mac OS X systems.

WebKit

Safari provides an "Enable Java" preference, which when unchecked should prevent the loading of Java applets. By default, Java applets are allowed to be loaded. Navigating to a maliciously crafted web page may allow a Java applet to be loaded without checking the preference. This update addresses the issue through a stricter check of the "Enable Java" preference. Credit to Scott Wilde for reporting this issue.

The International Domain Name (IDN) support and Unicode fonts embedded in Safari could be used to create a URL which contains look-alike characters. These could be used in a malicious web site to direct the user to a spoofed site that visually appears to be a legitimate domain. This update addresses the issue by through an improved domain name validity check.

Heap buffer overflows exist in the Perl Compatible Regular Expressions (PCRE) library used by the JavaScript engine in Safari. By enticing a user to visit a maliciously crafted web page, an attacker may trigger the issue, which may lead to arbitrary code execution. This update addresses the issue by performing additional validation of JavaScript regular expressions. Credit to Charlie Miller and Jake Honoroff of Independent Security Evaluators for reporting these issues.




by MacNN Staff

POST TOOLS:

TAGS :

toggle

Comments

  1. Guest

    Joined: Dec 1969

    0

    Safaria Beta update...

    I love it!

    Even on Windows. Do I say that?

    When are they going to fix the problem with loading PDF files?

    Wust jusdering....

    AnnaMiss

  1. Guest

    Joined: Dec 1969

    0

    Safaria Beta update...

    I love it!

    Even on Windows. Do I say that?

    When are they going to fix the problem with loading PDF files?

    Wust jusdering....

    AnnaMiss

Login Here

Not a member of the MacNN forums? Register now for free.

toggle

Network Headlines

toggle

Most Popular

MacNN Sponsor

Recent Reviews

Dell AD211 Bluetooth speaker

For all of the high-priced, over-engineered Bluetooth speakers in the electronics market, there is still room for mass-market solution ...

VisionTek 128GB USB Pocket SSD

USB flash drives dealt the death blow to both the floppy and Zip drives. While still faster than either of the old removable media, sp ...

Kodak PixPro SL10 Smart Lens Camera

Smartphone imagery still widely varies. Large Megapixel counts don't make for a good image, and the optics in some devices are lackin ...

toggle

Most Commented