Microsoft, however, did not delve into details of the Windows or IE vulnerabilities that could be combined with the Safari bug to hack PCs.Īviv Raff, an Israeli security researcher, filled in some of the blanks. In the advisory, Microsoft called out Windows XP - including SP3, the newest service pack - and Windows Vista as vulnerable, as well as Internet Explorer 6 and IE 7. "A combination of the default download location in Safari and how the Windows desktop handles executables creates a blended threat in which files may be downloaded to a user's machine without prompting, allowing them to be executed," said Microsoft.
DOWNLOAD SAFARI FOR WINDOWS XP SP3 UPDATE
"Restrict use of Safari as a Web browser until an appropriate update is available from Microsoft and/or Apple," the company told users in the advisory.īut Microsoft also acknowledged that a successful attack would require not only leveraging the Safari bug, but also exploiting a vulnerability in its own software. Then on Friday, Microsoft also fingered Safari as a problem. "We encourage Apple to reconsider its stance and treat this as the security issue that it is," said the group in a statement May 19. The next week, the anti-malware group criticized Apple for that position.
DOWNLOAD SAFARI FOR WINDOWS XP SP3 CODE
Attackers, Dhanjani claimed, could populate a malicious site with rogue code that Safari would automatically download to the desktop.Īpple told Dhanjani that it did not consider the problem a security issue, but might fix it in a future Safari update.
In mid-May, Dhanjani posted information about what he dubbed a "carpet bomb" attack made possible because Safari lacks an option to require a user's permission to download a file. "Clearly, that's what they're talking about," said Storms.
The Safari bug Microsoft referred to is the same one disclosed two weeks ago by researcher Nitesh Dhanjani, which Apple declined to treat as a security issue, said Andrew Storms, director of security operations at nCircle Network Security Inc. "Microsoft is investigating new public reports of a blended threat that allows remote code execution on all supported versions of Windows XP and Windows Vista when Apple's Safari for Windows has been installed," said the advisory.
0 kommentar(er)
