Microsoft Identified An Apple Bug

By markwolfe
in Back Page News

 Share

Recommended Posts

Grand Master

markwolfe Veteran

Posted
  • Veteran
Posted

Source: eFlux Media

Microsoft Corp. just issued a heads-up to its clients concerning the use of Apple Inc.?s Safari Web browser after several reports were presented about the occurrence of a rather dangerous system intrusion.

Apparently, a flaw found in Apple?s browser, known as the Safari bug, permits attackers to run unauthorized software on a victim?s computer and fill its desktop with potentially malicious executable files. The intrusion is also known as carpet bombing and the dangerous executables appear to users as normal Windows executables.

The flaw can lead to the complications presented earlier only combined with an unresolved bug in Internet Explorer. The IE bug has been reported to Microsoft more than a year ago and the connection with Apple?s flaw was discovered just last week.

Both the Safari and IE bugs "are moderate vulnerabilities that, combined, produce a critical flaw, which allows remote code execution," security researcher Aviv Raff told PCWorld.

Microsoft considers this to be a real threat to its users and issued a full security advisory three days ago, where it explained the vulnerability of the system and recommended all Windows users running the Safari browser to restrict its use until a safer version will be released by its developers or by Apple?s.

Apple already patched more than 17 vulnerabilities for the Windows Safari version and, surely, measures for identifying the mechanism?s full process and removing the bug will be taken as soon as possible.

According to Microsoft?s reports, the flaw affects all versions of Windows XP and Vista.

So, it seems that an Apple Safari bug can be used with an IE bug to cause a huge problem, if I read this right...

Link to comment
https://www.neowin.net/forum/topic/641045-microsoft-identified-an-apple-bug/
Share on other sites
Grand Master

markwolfe Veteran

Posted
  • Author
  • Veteran
Posted
Who uses that crap anyway on windows? everyone know OSX apps do not belong on windows.......

Oh... I am thinking some smaller web developers who want to check rendering in Safari, but haven't purchased an Apple PC.

Something along those lines?

ouch! for Apple fanboys :p
... combined with an unresolved bug in Internet Explorer. The IE bug has been reported to Microsoft more than a year ago
ouch for the Microsoft fanboys, too. ;)
Veteran

CelticWhisper

Posted
Posted

I normally use Firefox exclusively but I've been meaning to give Safari-Win32 a shot. I might hold off, though, now that this has surfaced. Safari's a nice enough browser on OSX but I'm always up for cross-platform testing.

Any word on when a fix is due out?

Grand Master

majortom1981

Posted
Posted

I refuse to use safari since its still being shoved down my throat. Every time quicktime wants to be updated by default it selects safri to install.

Why is it all sorts of lawsuits get brought up against microsoft for doing this but nobody says anything about apple doing it.

Grand Master

markwolfe Veteran

Posted
  • Author
  • Veteran
Posted
...

Why is it all sorts of lawsuits get brought up against microsoft for doing this but nobody says anything about apple doing it.

You are perfectly entitled to sue Apple for this, if you like. Maybe you can consult a lawyer specializing in this area of law, and see about starting a class-action lawsuit.

The lawyer can either get the ball rolling (especially if he sees fame and fortune in it!), or explain why it would not make a good valid lawsuit.

Grand Master

The Teej

Posted
Posted
Who uses that crap anyway on windows? everyone know OSX apps do not belong on windows.......

I use Safari on Vista, but it's really because I like to have the "main 4" (IE, Opera, FF, Safari) on my machine. I sometimes test websites, and this requires me to check it out on as many browsers as possible :p

Grand Master

zeroday

Posted
Posted
Oh... I am thinking some smaller web developers who want to check rendering in Safari, but haven't purchased an Apple PC.

Indeed.

The IE bug has been reported to Microsoft more than a year ago and the connection with Apple?s flaw was discovered just last week.

o.O, so if they fixed this one year old bug, this problem could have been potentially avoided? I blame MS more here then apple, but apple windows safari devs need a good smack for being lazy.

Grand Master

CPressland

Posted
Posted
Why dont they concentrate on fiding bugs in there own OS and programs rather than fidning flaw in there rivals.

Because that'd be a different team???? Do you think that the entire Apple Staff work on only one project at a time? And besides, there is only a handful of known bugs left in OS 10.5.3 now anyway.

This bug still exists in Internet Explorer should the right piece of Javascript be used.

Apple never said that Safari was secure, they said it was fast, I know because I only watched the WWDC07 podcast again the other day in anticipation for WWDC08

At current Firefox is probably the most secure browser, also very fast. Lets face facts, any browser is still better then Internet Explorer. I mean that thing still cant render PNGs properly and uses more then 500MB of memory at any given time.

Back on topic though I see no reason for Apple to fix this bug in a hurry. It's very minor and if you're messed about as a result of this bug then you're going on the wrong kind of websites anyway, Warez sites for example.

Collaborator

rtk

Posted
Posted (edited)
Apple never said that Safari was secure, they said it was fast, I know because I only watched the WWDC07 podcast again the other day in anticipation for WWDC08

They sure have, and continue to do so on their web page:

"Apple engineers designed Safari to be secure from day one."

It's very minor and if you're messed about as a result of this bug then you're going on the wrong kind of websites anyway, Warez sites for example.

If by minor, you mean major, I'd agree with you. Cross site vulnerabilities and infected ad networks can expose this on just about any site, not just pron or warez sites.

Edited by rtk
Experienced

thejohnnyq

Posted
Posted

Apple does make security claims, and has refuses to acknowledge issues like the type ahead security issue.

Here is a test, that i have preformed dozens of times, and it scares the hell of someone when they realize what they are seeing. This has been replicated on Safari under windows vista, xp, 2k8, 32 and 64 os, mac and now Ipod touch.

open safari browser and type in www. and wait for the address list to show. it will show addresses that have been hit from the ip address that is hitting the Internet. i have done this on several different locations and devices, and they all do this. I have just got a ipod touch and connected to the wap device and loaded safari, typed in w , over 57 web sites listed.

The only thing that i can find is that there is traffic to and from google address.

Try it and see.

Grand Master

markwolfe Veteran

Posted
  • Author
  • Veteran
Posted
...

At current Firefox is probably the most secure browser...

I don't use Opera, but from reviewing secunia advisories, and how many known items are open, from the "big 4", I would say Opera looks the best in that respect.
o.O, so if they fixed this one year old bug, this problem could have been potentially avoided? I blame MS more here then apple, but apple windows safari devs need a good smack for being lazy.
To be honest, neither bug was very serious on its own, from what the news item states. I guess the accolades for "customer focus" will go to whichever company fixes it first.
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • U.S. partially reverses Anthropic AI ban for Mythos but keeps Fable 5 off the market

      By wrack · Posted

      This is weird. Mythos is more unrestricted compared to Fable. Technically it poses more risk!!
    • SpaceX reportedly plans a Starlink mobile service for U.S. consumers

      By sava700 · Posted

      This is a great thing, I always have issues with Verizon while inside of certain football stadiums due to the saturation and walls blocking signal so a LOS way to connect would be great. Verizon was supposed to be offering sat data this year but I've not heard a word of it lately. Dude is sending rockets into space in a cheap manner, low waste foot print and has a great product with solar/battery tech. We would be so far behind China right now if not for him and a push to get back into space.
    • SpaceX reportedly plans a Starlink mobile service for U.S. consumers

      By sava700 · Posted

      illegally? Proof of that? Seems you are posting misinformation or well a pure straight up lie cause there is zero proof of such a thing. But I get it...
    • The official Funny Pictures thread

      By +Edouard · Posted

    • KillerPDF 1.6.0

      By Copernic · Posted

      KillerPDF 1.6.0 by Razvan Serea KillerPDF is a lightweight, portable PDF editor for Windows built for users who want full control without subscriptions, installers, or telemetry. It runs as a single executable, making it ideal for USB use and field work. You can view PDFs with smooth PDFium rendering, navigate quickly with thumbnails, zoom, and shortcuts, and reorganize pages using drag-and-drop. It supports merging multiple PDFs, splitting documents, and extracting selected pages. KillerPDF also allows inline text editing with font matching to preserve the original layout, plus annotations like text boxes, freehand drawing, highlights, and reusable signatures. You can search full text, copy content easily, and print documents with flattened annotations. Designed as a free and open alternative to bloated PDF tools, it works fully offline on Windows 10/11 x64. No runtimes install. Everything needed is inside the EXE (targets .NET Framework 4.8, which ships with every supported Windows release). KillerPDF key features: High-quality PDF rendering via PDFium Edit PDF text inline (double-click to modify text) Page thumbnails and fast navigation with zoom and shortcuts Merge multiple PDFs into one Split PDFs and extract selected pages Drag-and-drop page reordering Font matching to preserve original document appearance Text boxes for notes Freehand drawing tools Highlight overlays with adjustable color, size, opacity Undo actions and clear per-page annotations Create, draw, and save reusable signatures Click-to-place signatures anywhere Full-text search with highlighted results Drag-select or Ctrl+A to copy text Print with annotations flattened Portable single-file app (~15 MB) No installer, no admin rights required No account, no telemetry KillerPDF 1.6.0 changelog: A big release: major new features, a full visual refresh, and an internal rewrite. New Tabbed documents - open several PDFs at once, each restoring its page, zoom, and view OCR built into the exe (Tesseract) - OCR a page or dragged region to the clipboard, make a scan searchable, or extract all text; extra languages download on demand Digital signatures with a cloud certificate (Certum SimplySign), reusable signatures, and click-to-sign form fields Transform tool - rotate, scale, flip, and straighten a crooked scan, with live preview Edit existing text by double-clicking a line (the original is cleanly covered) Line tool, refreshed draw/highlight bars, resizable word-wrapping text boxes, and a full RGB color picker with eyedropper Print options (scale, position, margins, two-sided), page-number stamping, folder/.zip import, Document Info (F12), and recent files with file-type icons Translations: Bengali, Turkish, Simplified Chinese, German, French. Changed New logo, icons, fonts, and colors throughout Six themes with per-theme accent colors; sidebar docks left or right; toolbar style picker Internal rewrite: the ~15,000-line main window split into ~40 focused files (no behavior change) Fixed True 300 DPI printing, encrypted/damaged PDFs open on a background thread with a repair fallback, form fields render in every view mode, and undo is one item per press Download: KillerPDF 1.6.0 | 14.6 MB (Open Source) Link: KillerPDF Home Page | Github | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware

  • Recent Achievements

    • Week One Done
      flexorcist earned a badge
      Week One Done
    • One Month Later
      Woland13 earned a badge
      One Month Later
    • Week One Done
      Woland13 earned a badge
      Week One Done
    • One Year In
      bernmeister earned a badge
      One Year In
    • Week One Done
      Scoobystu earned a badge
      Week One Done

  • Popular Contributors

    1. 1
      +primortal
      499
    2. 2
      +Edouard
      221
    3. 3
      PsYcHoKiLLa
      147
    4. 4
      Steven P.
      75
    5. 5
      FloatingFatMan
      69
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!