Microsoft Identified An Apple Bug


Recommended Posts

Source: eFlux Media

Microsoft Corp. just issued a heads-up to its clients concerning the use of Apple Inc.?s Safari Web browser after several reports were presented about the occurrence of a rather dangerous system intrusion.

Apparently, a flaw found in Apple?s browser, known as the Safari bug, permits attackers to run unauthorized software on a victim?s computer and fill its desktop with potentially malicious executable files. The intrusion is also known as carpet bombing and the dangerous executables appear to users as normal Windows executables.

The flaw can lead to the complications presented earlier only combined with an unresolved bug in Internet Explorer. The IE bug has been reported to Microsoft more than a year ago and the connection with Apple?s flaw was discovered just last week.

Both the Safari and IE bugs "are moderate vulnerabilities that, combined, produce a critical flaw, which allows remote code execution," security researcher Aviv Raff told PCWorld.

Microsoft considers this to be a real threat to its users and issued a full security advisory three days ago, where it explained the vulnerability of the system and recommended all Windows users running the Safari browser to restrict its use until a safer version will be released by its developers or by Apple?s.

Apple already patched more than 17 vulnerabilities for the Windows Safari version and, surely, measures for identifying the mechanism?s full process and removing the bug will be taken as soon as possible.

According to Microsoft?s reports, the flaw affects all versions of Windows XP and Vista.

So, it seems that an Apple Safari bug can be used with an IE bug to cause a huge problem, if I read this right...

Link to comment
https://www.neowin.net/forum/topic/641045-microsoft-identified-an-apple-bug/
Share on other sites

Who uses that crap anyway on windows? everyone know OSX apps do not belong on windows.......

Oh... I am thinking some smaller web developers who want to check rendering in Safari, but haven't purchased an Apple PC.

Something along those lines?

ouch! for Apple fanboys :p
... combined with an unresolved bug in Internet Explorer. The IE bug has been reported to Microsoft more than a year ago
ouch for the Microsoft fanboys, too. ;)

I normally use Firefox exclusively but I've been meaning to give Safari-Win32 a shot. I might hold off, though, now that this has surfaced. Safari's a nice enough browser on OSX but I'm always up for cross-platform testing.

Any word on when a fix is due out?

I refuse to use safari since its still being shoved down my throat. Every time quicktime wants to be updated by default it selects safri to install.

Why is it all sorts of lawsuits get brought up against microsoft for doing this but nobody says anything about apple doing it.

...

Why is it all sorts of lawsuits get brought up against microsoft for doing this but nobody says anything about apple doing it.

You are perfectly entitled to sue Apple for this, if you like. Maybe you can consult a lawyer specializing in this area of law, and see about starting a class-action lawsuit.

The lawyer can either get the ball rolling (especially if he sees fame and fortune in it!), or explain why it would not make a good valid lawsuit.

Who uses that crap anyway on windows? everyone know OSX apps do not belong on windows.......

I use Safari on Vista, but it's really because I like to have the "main 4" (IE, Opera, FF, Safari) on my machine. I sometimes test websites, and this requires me to check it out on as many browsers as possible :p

Oh... I am thinking some smaller web developers who want to check rendering in Safari, but haven't purchased an Apple PC.

Indeed.

The IE bug has been reported to Microsoft more than a year ago and the connection with Apple?s flaw was discovered just last week.

o.O, so if they fixed this one year old bug, this problem could have been potentially avoided? I blame MS more here then apple, but apple windows safari devs need a good smack for being lazy.

Why dont they concentrate on fiding bugs in there own OS and programs rather than fidning flaw in there rivals.

Because that'd be a different team???? Do you think that the entire Apple Staff work on only one project at a time? And besides, there is only a handful of known bugs left in OS 10.5.3 now anyway.

This bug still exists in Internet Explorer should the right piece of Javascript be used.

Apple never said that Safari was secure, they said it was fast, I know because I only watched the WWDC07 podcast again the other day in anticipation for WWDC08

At current Firefox is probably the most secure browser, also very fast. Lets face facts, any browser is still better then Internet Explorer. I mean that thing still cant render PNGs properly and uses more then 500MB of memory at any given time.

Back on topic though I see no reason for Apple to fix this bug in a hurry. It's very minor and if you're messed about as a result of this bug then you're going on the wrong kind of websites anyway, Warez sites for example.

Apple never said that Safari was secure, they said it was fast, I know because I only watched the WWDC07 podcast again the other day in anticipation for WWDC08

They sure have, and continue to do so on their web page:

"Apple engineers designed Safari to be secure from day one."

It's very minor and if you're messed about as a result of this bug then you're going on the wrong kind of websites anyway, Warez sites for example.

If by minor, you mean major, I'd agree with you. Cross site vulnerabilities and infected ad networks can expose this on just about any site, not just pron or warez sites.

Edited by rtk

Apple does make security claims, and has refuses to acknowledge issues like the type ahead security issue.

Here is a test, that i have preformed dozens of times, and it scares the hell of someone when they realize what they are seeing. This has been replicated on Safari under windows vista, xp, 2k8, 32 and 64 os, mac and now Ipod touch.

open safari browser and type in www. and wait for the address list to show. it will show addresses that have been hit from the ip address that is hitting the Internet. i have done this on several different locations and devices, and they all do this. I have just got a ipod touch and connected to the wap device and loaded safari, typed in w , over 57 web sites listed.

The only thing that i can find is that there is traffic to and from google address.

Try it and see.

...

At current Firefox is probably the most secure browser...

I don't use Opera, but from reviewing secunia advisories, and how many known items are open, from the "big 4", I would say Opera looks the best in that respect.
o.O, so if they fixed this one year old bug, this problem could have been potentially avoided? I blame MS more here then apple, but apple windows safari devs need a good smack for being lazy.
To be honest, neither bug was very serious on its own, from what the news item states. I guess the accolades for "customer focus" will go to whichever company fixes it first.
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • The only reason I want to know where you from is because if you are not from the U.K, then why should you care what we in the U.K do or don't do? Racist I am not, I am fed up with the amount coming over here and feel they can come over here and think we need to support them. Do you know how much it costs this country to support these people coming over here? Even when we give them a place to live it is not good enough. We had a barge that was being used to house immigrants, oh but that was not good enough. A mate said to me at the time, when he was homeless, he would have been happy to live on the barge, instead of ending up sleeping on a bench on the beach. I am not scared to say what my family heritage is, unlike you who is scared to say where they are from or where they live. Father side U.S, mother side Wales, still have family living in the U.S. A mate who sadly died a few years ago, had a load of people from different races recording in his studio, I got on with all of them. Skin colour don't bother me, where they are from don't bother me. Religion don't bother me as long as they don't push it onto me and it is not crazy stuff. I am not religious. But if you are not living in the U.K, then why should you care if we are in the E.U or not? This the problem, too many people poking their noses into where it don't belong. But you believe what you believe, if you think I am racist, then be it, I really do not care. Just grow a pair
    • If he hasn't been able to figure that out, then why is he obsessed with tariffs? Because that's one of the most prominent tools to level the playing field when you have high cost of labor.
    • Microsoft released Windows 11 KB5102558, KB5095615 Setup and Recovery updates by Sayan Sen This past week Microsoft released the newest preview update (C-release) under KB5095093. Alongside those, Microsoft also released new dynamic updates. For those who may not know, dynamic updates bring improvements to the Windows Recovery process in the form of Windows Recovery Environment (WinRE) updates, which are also called Safe OS updates. The dynamic updates also affect the Setup file binaries in the form of Setup updates. These Dynamic Update packages are meant to be applied to existing Windows images prior to their deployment. Dynamic Updates also help preserve Language Pack (LP) and Features on Demand (FODs) content during the upgrade process. VBScript, for example, is currently an FOD on Windows 11 24H2. This time both recovery and setup updates were released for Windows 11. The company writes: "KB5095186: Safe OS Dynamic Update for Windows 11, version 26H1: June 23, 2026 This update makes improvements to the Windows recovery environment (WinRE). After installing this update, the WinRE version installed on the device should be 10.0.28000.2335. KB5102558: Setup Dynamic Update for Windows 11, versions 24H2 and 25H2: June 23, 2026 This update makes improvements to Windows setup binaries or any files that setup uses for feature updates in Windows 11, version 24H2 and Windows 11, version 25H2. KB5095615: Safe OS Dynamic Update for Windows 11, versions 24H2 and 25H2: June 23, 2026 This update makes improvements to the Windows recovery environment (WinRE). After installing this update, the WinRE version installed on the device should be 10.0.26100.8737." Microsoft notes that both the Recovery and Setup updates will be downloaded and installed automatically via the Windows Update channel.
    • The high cost of labor and operating within the US. Donald hasn't been able to figure that out--pathetic.
  • Recent Achievements

    • Conversation Starter
      jessse3334 earned a badge
      Conversation Starter
    • Reacting Well
      JuvenileDelinquent earned a badge
      Reacting Well
    • One Month Later
      Excellence2025 earned a badge
      One Month Later
    • Week One Done
      Excellence2025 earned a badge
      Week One Done
    • Week One Done
      flexorcist earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      508
    2. 2
      +Edouard
      200
    3. 3
      PsYcHoKiLLa
      151
    4. 4
      Steven P.
      73
    5. 5
      macoman
      62
  • Tell a friend

    Love Neowin? Tell a friend!